3 ms·

What makes Jails so far ahead of containers in your opinion?

doublerabbit 3y ago
Not op, but for me: You can setup Linux in a jail. You can nest bhyve virtual machines in a jail. You can assign individual NICs to a jail. You can encrypt with ZFS a jail. You can run browsers in a jail with full set of features.
- betaby 3y ago
  All of those available on Linux and even more, see https://www.man7.org/linux/man-pages/man1/systemd-nspawn.1.html https://www.man7.org/linux/man-pages/man1/systemd-nspawn.1.h...
  - doublerabbit 3y ago
    I don't see the guide to run FreeBSD in a container from that man page. And what about if my Linux Distro doesn't use system-md, like Slackware.
    - betaby 3y ago
      > And what about if my Linux Distro doesn't use system-md, like Slackware. It's a choice of Slackware not use systemd infra. However on Linuxes you have more that one choice to run containers, your next option would be LXC/LDX https://docs.slackware.com/howtos:misc:lxc https://docs.slackware.com/howtos:misc:lxc
      - doublerabbit 3y ago
        Sure and my choice not to use it too. Well aware of LXC too. I'm not claiming Linux can't. I was stating why. I know Linux can do what FreeBSD can do, but BSD does it better. However both are pretty much mimicked concept from Solaris Zones
        sillystuff 3y ago
        > However both are pretty much mimicked concept from Solaris Zones Your timeline is off. FreeBSD and Linux were within a year of each other (not in-tree on linux, but Debian packaged VServer kernels and VServer + GRSec kernels; we used vserver+grsec debian packaged kernels at work in the mid through late '00s). Solaris containers came years later. 2000 - FreeBSD jails 2001 - Linux VServer 2004 - Solaris Containers https://blog.aquasec.com/a-brief-history-of-containers-from-1970s-chroot-to-docker-2016 https://blog.aquasec.com/a-brief-history-of-containers-from-...
    - 5e92cb50239222b 3y ago
      I wonder why would anyone spend time on developing and maintaining that. FreeBSD needs Linux userland and syscall support to get roughly the same level of software compatibility. The opposite isn't true (maybe it is for your special snowlake internal application developed specifically for FreeBSD, but it isn't so in general case). All other things you have mentioned are possible with pretty much any of the Linux container runtimes. systemd-nspawn is just one of them, and I don't think it is actually used very much compared to the alternatives.
- jmillikin 3y ago
  Most of those are supported by "containers", which are after all just a chroot and a process tree with restricted visibility into certain kernel objects. Assigning individual NICs or running a browser with extra isolation is one of the classic Linux namespace tutorials. > You can setup Linux in a jail. I don't see how this can be possible. Could you explain more how to boot a Linux kernel within a FreeBSD jail? edit: I'm not talking about running binaries compiled for Linux under FreeBSD. The parent said it's possible to set up Linux within a jail, so I want to see instructions to boot an actual Linux kernel as a FreeBSD process.
  - rwaksmunski 3y ago
    You use FreeBSD kernel and Linux userland. FreeBSD can emulate Linux system calls.
    - School-Cotton 3y ago
      There is no such thing as “Linux userland”. Obviously you can port most GNU utilities and other things that are typically run on Linux on FreeBSD but that’s a far cry from “running Linux”.
  - deleted 3y ago
    [deleted]
  - NexRebular 3y ago
    Using the linuxulator. https://wiki.freebsd.org/LinuxJails https://wiki.freebsd.org/LinuxJails
  - throw0101c 3y ago
    > Assigning individual NICs or running a browser with extra isolation is one of the classic Linux namespace tutorials. With FreeBSD you can set up a standalone virtualized network stack: * https://klarasystems.com/articles/virtualize-your-network-on-freebsd-with-vnet/ https://klarasystems.com/articles/virtualize-your-network-on... * https://man.freebsd.org/cgi/man.cgi?vnet https://man.freebsd.org/cgi/man.cgi?vnet * https://wiki.freebsd.org/Jails/VNET https://wiki.freebsd.org/Jails/VNET

Not op, but for me: You can setup Linux in a jail. You can nest bhyve virtual machines in a jail. You can assign individual NICs to a jail. You can encrypt with ZFS a jail. You can run browsers in a jail with full set of features.

betaby 3y ago
All of those available on Linux and even more, see https://www.man7.org/linux/man-pages/man1/systemd-nspawn.1.html https://www.man7.org/linux/man-pages/man1/systemd-nspawn.1.h...
- doublerabbit 3y ago
  I don't see the guide to run FreeBSD in a container from that man page. And what about if my Linux Distro doesn't use system-md, like Slackware.
  - betaby 3y ago
    > And what about if my Linux Distro doesn't use system-md, like Slackware. It's a choice of Slackware not use systemd infra. However on Linuxes you have more that one choice to run containers, your next option would be LXC/LDX https://docs.slackware.com/howtos:misc:lxc https://docs.slackware.com/howtos:misc:lxc
    - doublerabbit 3y ago
      Sure and my choice not to use it too. Well aware of LXC too. I'm not claiming Linux can't. I was stating why. I know Linux can do what FreeBSD can do, but BSD does it better. However both are pretty much mimicked concept from Solaris Zones
      - sillystuff 3y ago
        > However both are pretty much mimicked concept from Solaris Zones Your timeline is off. FreeBSD and Linux were within a year of each other (not in-tree on linux, but Debian packaged VServer kernels and VServer + GRSec kernels; we used vserver+grsec debian packaged kernels at work in the mid through late '00s). Solaris containers came years later. 2000 - FreeBSD jails 2001 - Linux VServer 2004 - Solaris Containers https://blog.aquasec.com/a-brief-history-of-containers-from-1970s-chroot-to-docker-2016 https://blog.aquasec.com/a-brief-history-of-containers-from-...
  - 5e92cb50239222b 3y ago
    I wonder why would anyone spend time on developing and maintaining that. FreeBSD needs Linux userland and syscall support to get roughly the same level of software compatibility. The opposite isn't true (maybe it is for your special snowlake internal application developed specifically for FreeBSD, but it isn't so in general case). All other things you have mentioned are possible with pretty much any of the Linux container runtimes. systemd-nspawn is just one of them, and I don't think it is actually used very much compared to the alternatives.
jmillikin 3y ago
Most of those are supported by "containers", which are after all just a chroot and a process tree with restricted visibility into certain kernel objects. Assigning individual NICs or running a browser with extra isolation is one of the classic Linux namespace tutorials. > You can setup Linux in a jail. I don't see how this can be possible. Could you explain more how to boot a Linux kernel within a FreeBSD jail? edit: I'm not talking about running binaries compiled for Linux under FreeBSD. The parent said it's possible to set up Linux within a jail, so I want to see instructions to boot an actual Linux kernel as a FreeBSD process.
- rwaksmunski 3y ago
  You use FreeBSD kernel and Linux userland. FreeBSD can emulate Linux system calls.
  - School-Cotton 3y ago
    There is no such thing as “Linux userland”. Obviously you can port most GNU utilities and other things that are typically run on Linux on FreeBSD but that’s a far cry from “running Linux”.
- deleted 3y ago
  [deleted]
- NexRebular 3y ago
  Using the linuxulator. https://wiki.freebsd.org/LinuxJails https://wiki.freebsd.org/LinuxJails
- throw0101c 3y ago
  > Assigning individual NICs or running a browser with extra isolation is one of the classic Linux namespace tutorials. With FreeBSD you can set up a standalone virtualized network stack: * https://klarasystems.com/articles/virtualize-your-network-on-freebsd-with-vnet/ https://klarasystems.com/articles/virtualize-your-network-on... * https://man.freebsd.org/cgi/man.cgi?vnet https://man.freebsd.org/cgi/man.cgi?vnet * https://wiki.freebsd.org/Jails/VNET https://wiki.freebsd.org/Jails/VNET