2 ms·
bHyve in jails is a god send. I can create a jail, pass bHyve to it, allocate resources limits, assign a virtual nic enabling the jail to utilise firewalls.
by doublerabbit 3y ago
bHyve in jails is a god send.
I can create a jail, pass bHyve to it, allocate resources limits, assign a virtual nic enabling the jail to utilise firewalls. And then hand the jail IP to a client. Enabling them to create as many virtual machines their resources allows.
Using Jails this itself enables another level of security.
As if a VM hack breaks free, itself is then only isolated to the jail. And, if I was to be truely paranoid I could create a fortress jail with sub jails with a jail in the sub jail allowing bHyve to operate within.
Backups are only a matter of backing up the jail. ZFS does this without sweat.
- ilyt 3y agoThat's interesting way to do shared hosting, can jails limit by CPU time ?
- doublerabbit 3y agoYou can with rctl [0][1]. Another hack was one where you could use tcsh shell and /etc/login launching an application as a man in the middle to limit and launch a process with cpu limits. [0] https://klarasystems.com/articles/controlling-resource-limits-with-rctl-in-freebsd/ https://klarasystems.com/articles/controlling-resource-limit... [1] https://wiki.freebsd.org/Hierarchical_Resource_Limits https://wiki.freebsd.org/Hierarchical_Resource_Limits