<sect1 id="jail-file-backed">

    <title>File-Backed Jails</title>

      <sect2 id="jail-creating-file-backed">

      <sect2info>

	<authorgroup>

	  <author>

	    <firstname>Glen</firstname>

	    <surname>Barber</surname>

	    <contrib>Contributed by </contrib>

	    <!-- 23 November 2009 -->

	  </author>

	</authorgroup>

      </sect2info>

      <title>Creating a File-Backed Jail</title>

      <para>

        The &man.jail.8; environment alone provides no mechanism to restrict disk

        space used by the &man.jail.8;.  Though there are many way to achieve this,

        for example, using separate disk slices for each &man.jail.8;, this section

        will show you how to create file-backed jails using &man.md.4; devices.</para>

      <sect3 id="jail-creating-memory-file">

       <title>Creating the Memory File</title>

        <para>In this section, there will be one &man.jail.8; created in the <filename

          class="directory">/usr/jails/www</filename> directory, using <filename

          class="directory">/usr/jails/images</filename> as the directory 

          containing the image file.</para>

        <procedure>

          <step>

            <para>Create the directories and image file for the jail:</para>

              <screen>&prompt.root; <userinput>mkdir /usr/jails</userinput>

&prompt.root; <userinput>cd /usr/jails</userinput>

&prompt.root; <userinput>mkdir images www</userinput></screen></step>

          <step>

            <para>Create the vnode-backed &man.md.4; device using &man.mdmfs.8;,

              backed by <filename>www.img</filename>.  In the below example, the

              image file is 10 gigabytes in size:</para>

            <screen>&prompt.root; <userinput>touch images/www.img</userinput>

&prompt.root; <userinput>mdmfs -F images/www.img -s 10g md101 /usr/jails/www</userinput></screen>

            <note>

	      <para>Please note, although the <filename>www.img</filename> file

	        was created as a 10 Gigabyte file, only 8 Gigabytes will be shown

		as available.  On default UFS filesystems, the system reserves 8 

		percent of the filesystem.  For more information, please read 

		&man.tunefs.8;.

              </para>

            </note>

          </step>

          <step>

            <para>&man.df.1; output should present output similar to the following:</para>

            <screen>Filesystem         1K-blocks      Used     Avail Capacity  Mounted on

/dev/mirror/gm0s1a   4058062    478866   3254552    13%    /

devfs                      1         1         0   100%    /dev

/dev/mirror/gm0s1e    507630       398    466622     0%    /tmp

/dev/mirror/gm0s1f 461439472 115610770 308913546    27%    /usr

/dev/mirror/gm0s1d   3008142    137834   2629658     5%    /var

/dev/md101           9159102         4   8426370     0%    /usr/jails/www</screen>

          </step>

        </procedure>

      </sect3>

       <sect3 id="jail-file-backed-fstab">

        <title>Edit <filename>/etc/fstab</filename></title>

         <procedure>

           <step>

             <para>The memory devices will not be automatically recreated after rebooting

               the system.  To achieve this, edit <filename>/etc/fstab</filename>.  An

               example &man.fstab.5; configuration:</para>

             <screen># Device                Mountpoint      FStype  Options         Dump    Pass#

/dev/mirror/gm0s1b      none            swap    sw              0       0

/dev/mirror/gm0s1a      /               ufs     rw              1       1

/dev/mirror/gm0s1e      /tmp            ufs     rw              2       2

/dev/mirror/gm0s1f      /usr            ufs     rw              2       2

/dev/mirror/gm0s1d      /var            ufs     rw              2       2

/dev/acd0               /cdrom          cd9660  ro,noauto       0       0

# www jail

md101      /usr/jails/www mfs rw,-P,-F/usr/jails/images/www.img 0       0</screen>

           </step>

           <step>

             <para>To verify the system will &man.mount.8; the device successfully 

	       after a system reboot, verify there are no &man.fstab.5; 

	       errors:</para>

             <screen><userinput>&prompt.root; mount -a </userinput></screen>

           </step>

         </procedure>

           <para>Following the steps outlined in the beginning of this chapter,

	     create the &man.jail.8; using <filename 

	     class="directory">/usr/jails/www</filename> as the destination

             directory.</para>

           <para>Should you find the need to move this jail to another machine, 

	     stop the &man.jail.8;, &man.umount.8; <filename 

	     class="directory">/usr/jails/www</filename>, and copy the 

	     <filename>www.img</filename> file to the remote machine.</para>

      </sect3>

    </sect2> 

  </sect1>