Learn FreeBSD - Jails (Native Containerization)

#Introduction

In the previous episode 14, you secured communication with OpenSSL and SSH. Now we get to one of FreeBSD's most distinctive features: jails — native containerization that isolates processes, filesystems, and networking at the OS level. Each jail has its own root, users, and network yet shares the kernel with the host — FreeBSD's way of running many "virtual servers" without the overhead of full virtualization.

#The Jail Concept

#What Gets Isolated

A jail confines processes within it to a defined environment:

Filesystem — a jail root different from the host's.
Network — a dedicated IP address or a virtual network stack.
Processes — only processes inside the jail can see each other.
Users — UIDs inside a jail are not the same as host UIDs.

#Jails vs Linux Containers

Info

Jails are different from Docker. Docker wraps processes in namespaces and cgroups, while a jail isolates an entire operating system environment on the same kernel. Jails are closer to a "lightweight VM" than a Docker-style container — stable and bootable like a small system.

#Creating Jails with jail(8)

#Basic Structure

The simplest jail needs its own root filesystem. The common way to provide it: using the base system via bsdinstall or a template, or sharing read-only via mount:

Membuat direktori jail

mkdir -p /usr/jails/www
bsdinstall jail /usr/jails/www

bsdinstall jail installs a new base system into the jail directory — much like installing a mini FreeBSD for that jail.

#Configuration in /etc/jail.conf

Jails are configured in /etc/jail.conf:

Contoh /etc/jail.conf

www {
  host.hostname = "www.example.local";
  ip4.addr = "192.168.1.20";
  path = "/usr/jails/www";
  exec.start = "/bin/sh /etc/rc";
  exec.consolelog = "/var/log/jail_www_console.log";
}

#Running the Jail

With jail.conf ready, run and inspect it:

Menjalankan dan memeriksa jail

service jail start www
jls
jexec www ps aux

jls shows all active jails with their JID and IP. jexec runs a command inside the jail — the way to "get into" that environment.

#Entering the Jail Console

To enter as root inside the jail:

Masuk ke jail

jexec www /bin/sh

#Modern Jail Management

#ezjail: Template Management

ezjail simplifies creating many jails with templates:

Menginstal ezjail

pkg install ezjail
sysrc ezjail_enable="YES"
ezjail-admin install

Create a jail from a template:

Membuat jail dengan ezjail

ezjail-admin create web01 "192.168.1.21"
ezjail-admin start web01
ezjail-admin console web01

ezjail handles base jail creation, cloning, and day-to-day management with short commands.

#Bastille: Modern Management

Bastille is the newest generation — a modern CLI, ZFS support, templates, and flexible networking:

Menginstal bastille

pkg install bastille
sysrc bastille_enable="YES"
service bastille start

Download the base system and create a container:

Membuat container bastille

bastille bootstrap 15.1-RELEASE
bastille create web02 15.1-RELEASE 192.168.1.22
bastille start web02
bastille console web02

Success

Bastille brings jails to the modern level: automatic ZFS snapshots, templates for rolling out uniform environments, and easy VNET networking. Whether for a homelab or production, Bastille is a highly recommended starting point.

#Jail Networking

#Shared Networking

In the default mode, a jail shares the host's network stack and only has its own IP on the host interface. The ip4.addr configuration in jail.conf is this form — simple and sufficient for most cases.

#VNET: A Virtual Network per Jail

VNET gives each jail its own network stack complete with virtual interfaces:

Jail dengan VNET

vnet;
vnet.interface = "epair0b";
exec.prestart = "ifconfig epair0a create";
exec.prestart += "ifconfig epair0a up";
exec.poststart = "ifconfig bridge0 addm epair0a";

With VNET, a jail can have its own interfaces, its own routing, and even run its own firewall — truly full network isolation.

Warning

VNET gives great power but also complexity: epair interfaces need to be attached to a host bridge, and routing inside the jail must be configured on its own. Start with shared networking, then move to VNET when isolation needs grow.

#Shared vs Dedicated Networking

Mode	Advantages	Disadvantages
Shared (IP on host)	Simple, lightweight	Limited network isolation
VNET	Full isolation, own firewall	More complex configuration

#Jail Best Practices

One jail per service — don't pile many services into a single jail.
Update jails periodically; the base jail can be upgraded from a template.
Use one ZFS dataset per jail for easy snapshots and backups.
Limit resources with rctl when needed.
Don't run jails as root from the host for things that don't need it.

Audit jail berjalan

jls
jexec www zfs list

#Closing

In this episode 15, you understood FreeBSD jails: the concept of OS-level isolation, creating them with jail(8), configuring /etc/jail.conf, the jls and jexec commands, and modern management with ezjail and bastille, including shared and VNET networking.

Key takeaways:

Jails isolate filesystem, network, and processes at the OS level on a shared kernel.
Jail configuration is centralized in /etc/jail.conf; manage with service jail.
jls inspects active jails; jexec enters them.
ezjail makes templates easy; bastille is modern with ZFS and VNET.
Start with shared networking, move to VNET when you need full isolation.

In the next episode, episode 16, we'll cover bhyve & virtualization — FreeBSD's built-in type-2 hypervisor, using bhyve and bhyvectl, the vm-bhyve frontend, and the practice of installing Linux and FreeBSD VMs with UEFI, virtio storage, and tap/bridge networking.