* The different type of jails.

* The different types of jail.

* The different way to configure the network for a jail.

* The different ways to configure the network for a jail.

* How to create the different types of jails.

* How to create the different types of jail.

* How to start, stop and restart a jail.

* How to start, stop, and restart a jail.

* How to upgrade the different types of jails.

* How to upgrade the different types of jail.

== Jail types

== Jail Types

Below can be found a list of the different types, their characteristics, etc.

Below can be found a list of the different types, their characteristics, and considerations for use.

A thick jail is a more traditional form of FreeBSD Jail.

A thick jail is a traditional form of FreeBSD Jail.

* Resource overhead: Because each jail maintains its own separate base system, it consumes more resources compared to thin jails.

* Resource overhead: Because each jail maintains its own separate base system, thick jails consume more resources compared to thin jails.

In summary, a FreeBSD Thick Jail is a type of FreeBSD Jail that replicates a substantial portion of the base system within the isolated environment.

In summary, a FreeBSD Thin Jail is a type of FreeBSD Jail that replicates a substantial portion, but not all, of the base system within the isolated environment.

* Unified Maintenance: Since thin jails share the majority of their base system with the host system, updates and maintenance of common base system components (such as libraries and binaries) only need to be done once on the host. This simplifies the maintenance process compared to maintaining individual base system for each thick jail.

* Unified Maintenance: Since thin jails share the majority of their base system with the host system, updates and maintenance of common base system components (such as libraries and binaries) only need to be done once on the host. This simplifies the maintenance process compared to maintaining an individual base system for each thick jail.

Before creating any jail on the host system it is necessary to perform certain configurations and obtain some information from the host system.

Before creating any jail on the host system it is necessary to perform certain configuration and obtain some information from the host system.

It will be necessary to configure the man:jail[8] utility, create the necessary directories to configure and install the jails, obtain information from the host's network and check if the host uses OpenZFS or UFS as file system.

It will be necessary to configure the man:jail[8] utility, create the necessary directories to configure and install jails, obtain information from the host's network, and check whether the host uses OpenZFS or UFS as its file system.

The FreeBSD version running in the jail can not be newer that the version running in the host

The FreeBSD version running in the jail can not be newer that the version running in the host.

[[host-configuration-jail-Utility]]

[[host-configuration-jail-utility]]

To start the jails when the system boots, run the following commands:

To start jails when the system boots, run the following commands:

With `jail_parallel_start` all configured jails will be started in the background.

With `jail_parallel_start`, all configured jails will be started in the background.

=== Setting up the Jail Directory Tree

=== Setting Up the Jail Directory Tree

When using OpenZFS, execute the following commands to create the dataset:

When using OpenZFS, execute the following commands to create datasets for these directories:

There are two ways to configure the jails.

There are two ways to configure jails.

<.> `allow.raw_sockets` - Allow to create raw sockets. Setting this parameter allows utilities like man:ping[8] and man:traceroute[8] to operate inside the jail.

<.> `allow.raw_sockets` - Allow creating raw sockets inside the jail. Setting this parameter allows utilities like man:ping[8] and man:traceroute[8] to operate inside the jail.

<.> `path` - The directory which is to be the root of the jail. Any commands run inside the jail, either by jail or from man:jexec[8], are run from this directory.

<.> `path` - The directory which is to be the root of the jail. Any commands that are run inside the jail, either by jail or from man:jexec[8], are run from this directory.

<.> `ip4.addr` - IPv4 address. There are two configuration possibilities for IPv4, the first is to establish an IP or a list of IPs as has been done in the example. The other is to use `ip4` instead and set the `inherit` value to inherit the host's IP address.

<.> `ip4.addr` - IPv4 address. There are two configuration possibilities for IPv4. The first is to establish an IP or a list of IPs as has been done in the example. The other is to use `ip4` instead and set the `inherit` value to inherit the host's IP address.

<.> `ip6.addr` - IPv6 address. There are two configuration possibilities for IPv6, the first is to establish an IP or a list of IPs as has been done in the example. The other is to use `ip6` instead and set the `inherit` value to inherit the host's IP address.

<.> `ip6.addr` - IPv6 address. There are two configuration possibilities for IPv6. The first is to establish an IP or a list of IPs as has been done in the example. The other is to use `ip6` instead and set the `inherit` value to inherit the host's IP address.

In principle, a jail only needs a hostname, a root directory, an IP address and a userland.

In principle, a jail only needs a hostname, a root directory, an IP address, and a userland.

Once the download is complete it will be necessary to extract the contents into the jail directory.

Once the download is complete, it will be necessary to extract the contents into the jail directory.

Execute the following commands to extract the userland into jail's directory:

Execute the following commands to extract the userland into the jail's directory:

With the userland extracted in the jail directory, will be necessary to copy the timezone and the DNS servers files:

With the userland extracted in the jail directory, it will be necessary to copy the timezone and DNS server files:

With the files moved the next thing to do is update to the latest patch level executing the following command:

With the files copied, the next thing to do is update to the latest patch level by executing the following command:

The last step will be to configure it.

The last step is to configure the jail.

It will be necessary to add an entry to the configuration file [.filename]#/etc/jail.conf# or in [.filename]#jail.conf.d# with the data of the jail.

It will be necessary to add an entry to the configuration file [.filename]#/etc/jail.conf# or in [.filename]#jail.conf.d# with the parameters of the jail.

And then execute the following command to start the jail:

Execute the following command to start the jail:

Although the Thin Jails use the same technology, the creation is different.

Although Thin Jails use the same technology as Thick Jails, the creation procedure is different.

=== Creating a Thin Jail using OpenZFS Snapshots

=== Creating a Thin Jail Using OpenZFS Snapshots

To create a Thin Jail using OpenZFS Snapshots the first step will be to create a template.

To create a Thin Jail using OpenZFS Snapshots the first step is to create a template.

The templates will only be used to create new jails, for this reason they are created in "read-only" mode, in order to create jails easily with an immutable base.

Templates will only be used to create new jails.

For this reason they are created in "read-only" mode so that jails are created with an immutable base.

To create the dataset to save the template execute the following command:

To create the dataset for the template, execute the following command:

Once the download is complete it will be necessary to extract the contents in the template directory executing the following command:

Once the download is complete, it will be necessary to extract the contents in the template directory by executing the following command:

With the userland extracted in the templates directory, it will be necessary to copy the timezone and the DNS servers files to the template directory executing the following command:

With the userland extracted in the templates directory, it will be necessary to copy the timezone and DNS server files to the template directory by executing the following command:

The next thing to do is update to the latest patch level executing the following command:

The next thing to do is update to the latest patch level by executing the following command:

Once the update is finished the template will be ready.

Once the update is finished, the template is ready.

To create the OpenZFS Snapshot from the template execute the following command:

To create an OpenZFS Snapshot from the template, execute the following command:

Once the OpenZFS Snapshot has been created infinite jails can be created using the OpenZFS clone function.

Once the OpenZFS Snapshot has been created, infinite jails can be created using the OpenZFS clone function.

To create a Thin Jail named `thinjail` execute the following command:

To create a Thin Jail named `thinjail`, execute the following command:

The last step is to configure it.

The last step is to configure the jail.

It will be necessary to add an entry to the configuration file [.filename]#/etc/jail.conf# or in [.filename]#jail.conf.d# with the data of the jail.

It will be necessary to add an entry to the configuration file [.filename]#/etc/jail.conf# or in [.filename]#jail.conf.d# with the parameters of the jail.

And then execute the following command to start the jail:

Execute the following command to start the jail:

=== Creating a Thin Jail using NullFS

=== Creating a Thin Jail Using NullFS

Combining Thin Jails and NullFS, a jail can be created with reduced duplication of system files by using Thin Jail techniques,

A jail can be created with reduced duplication of system files by using the Thin Jail technique and using NullFS to selectively share specific directories from the host system into the jail.

and use NullFS to selectively share specific directories from the host system into the jail.

Once the download is complete it will be necessary to extract the contents in the template directory executing the following command:

Once the download is complete, it will be necessary to extract the contents in the template directory by executing the following command:

Once the userland is extracted n the templates directory, it will be necessary to copy the timezone and the DNS servers files to the template directory executing the following command:

Once the userland is extracted in the templates directory, it will be necessary to copy the timezone and DNS server files to the template directory by executing the following command:

With the files moved to the template, the next thing to do is update to the latest patch level executing the following command:

With the files moved to the template, the next thing to do is update to the latest patch level by executing the following command:

The next step will be to create the symlinks to the `skeleton` by executing the following commands:

The next step is to create the symlinks to the `skeleton` by executing the following commands:

In case of using OpenZFS, the OpenZFS snapshots will be a good ally to create as many jails as necessary by executing the following commands:

In case of using OpenZFS, OpenZFS snapshots can be used to easily create as many jails as necessary by executing the following commands:

In case of using UFS the man:cp[1] program can be used executing the following commands:

In case of using UFS the man:cp[1] program can be used by executing the following commands:

Add the jail entry in [.filename]#/etc/jail.conf# as follows:

Add a jail entry in [.filename]#/etc/jail.conf# or a file in [.filename]#jail.conf.d# as follows:

Then the jail can be started as usual:

Execute the following command to start the jail:

FreeBSD VNET Jails have its own distinct networking stack, including interfaces, IP addresses, routing tables and firewall rules.

FreeBSD VNET Jails have their own distinct networking stack, including interfaces, IP addresses, routing tables, and firewall rules.

The first step will be to create the man:bridge[4] executing the following command:

The first step to create a VNET jail is to create the man:bridge[4] by executing the following command:

With the `bridge` already created, it will be necessary to attach it to the `em0` interface by executing the following commands:

With the `bridge` created, it will be necessary to attach it to the `em0` interface by executing the following command:

To make this setting persist across reboots add the following lines to [.filename]#/etc/rc.conf#:

To make this setting persist across reboots, add the following lines to [.filename]#/etc/rc.conf#:

With the bridge already created, the next step will be to create the jail as indicated above.

The next step is to create the jail as indicated above.

Either the <<classic-jail>> procedure and the <<thin-jail>> procedure can be used, the only thing that will change will be the configuration of the [.filename]#/etc/jail.conf# file.

Either the <<classic-jail>> procedure and the <<thin-jail>> procedure can be used.

The only thing that will change is the configuration in the [.filename]#/etc/jail.conf# file.

This configuration for the VNET jail will be used as an example:

The following is an example configuration for a VNET jail:

FreeBSD can run Linux inside a jail using the crossref:linuxemu[linuxemu,Linux Binary Compatibility] and man:debootstrap[8].

FreeBSD can run Linux inside a jail using crossref:linuxemu[linuxemu,Linux Binary Compatibility] and man:debootstrap[8].

Jails do not have a kernel, they run on the host's kernel.

Jails do not have a kernel.

Therefore it is necessary to enable the Linux Binary Compatibility in the host system.

They run on the host's kernel.

Therefore it is necessary to enable Linux Binary Compatibility in the host system.

The FreeBSD Linux jails require a specific configuration that will be detailed below.

FreeBSD Linux jails require a specific configuration that will be detailed below.

Once the machine has been created as explained above, execute the following command to perform some configurations to the machine and start it:

Once the jail has been created as explained above, execute the following command to perform required configuration for the jail and start it:

Then it will be necesary to access the jail to install package:sysutils/debootstrap[].

To access the jail, it will be necessary to install package:sysutils/debootstrap[].

Inside the jail execute the following commands to install package:sysutils/debootstrap[] and prepare the Ubuntu environment:

Inside the jail, execute the following commands to install package:sysutils/debootstrap[] and prepare the Ubuntu environment:

And access to the Ubuntu environment using the following command:

The Ubuntu environment can be accessed using the following command:

Once the jail is created, there are a number of operations that can be performed like starting, rebooting or deleting the jail, installing software in it, etc.

Once the jail is created, there are a number of operations that can be performed, like starting, rebooting or deleting the jail, installing software in it, etc.

In this section the different actions that can be done with the jails created in the host will be described.

In this section the different actions that can be done with jails from the host will be described.

To list the different jails that are running on the host system, the command man:jls[8] can be used:

To list the jails that are running on the host system, the command man:jls[8] can be used:

=== Start, Restart and Stop a Jail

=== Start, Restart, and Stop a Jail

Destroying a jail is not as simple as stopping the jail using man:service[8], removing the jail directory and the [.filename]#/etc/jail.conf# entry.

Destroying a jail is not as simple as stopping the jail using man:service[8] and removing the jail directory and [.filename]#/etc/jail.conf# entry.

The first step will be to stop the desired jail executing the following command:

The first step is to stop the desired jail executing the following command:

The second step will be to remove these flags with man:chflags[1] executing the following command, in which `classic` is the name of the jail to remove:

The second step is to remove these flags with man:chflags[1] by executing the following command, in which `classic` is the name of the jail to remove:

The third step will be to delete the directory where the jail was:

The third step is to delete the directory where the jail was:

Finally, it will be necessary to remove the jail entry in the file [.filename]#/etc/jail.conf#.

Finally, it will be necessary to remove the jail entry in [.filename]#/etc/jail.conf# or in [.filename]#jail.conf.d#.

For example, to install package:nginx-lite[] in the jail, the next command will be executed *from the host*:

For example, to install package:nginx-lite[] in the jail, the next command can be executed *from the host*:

For more information on working with packages on FreeBSD see the chapter // TODO: Link to the chapter

For more information on working with packages in FreeBSD, see crossref:ports[ports,"Installing Applications: Packages and Ports"].

=== Execute commands in a Jail

=== Execute Commands in a Jail

This will prevent the update of some fails so updating from withing the jail will fail.

This will prevent the update of some files so updating from withing the jail will fail.

To update the jail to the latest patch release of the version of FreeBSD it is already running, execute the following commands on the host:

To update the jail to the latest patch release of the version of FreeBSD it is running, execute the following commands on the host:

It is necessary to execute two times the `install` step.

It is necessary to execute the `install` step two times.

The first one to upgrade the kernel and the second one to the rest of the components.

The first one upgrades the kernel, and the second one upgrades the rest of the components.

=== Upgrading a Thin Jail using NullFS

=== Upgrading a Thin Jail Using NullFS

Since Thin Jails that use NullFS share the majority of system directories, they are very easy to update, it is enough to update the template.

Since Thin Jails that use NullFS share the majority of system directories, they are very easy to update.

This will allow to update multiple jails at the same time.

It is enough to update the template.

This allows updating multiple jails at the same time.

To update the template to the latest patch release of the version of FreeBSD it is already running, then execute the following commands on the host:

To update the template to the latest patch release of the version of FreeBSD it is running, execute the following commands on the host:

For example to upgrade from 13.1-RELEASE to 13.2-RELEASE, execute the following commands on the host:

For example, to upgrade from 13.1-RELEASE to 13.2-RELEASE, execute the following commands on the host:

[[jail-resources-limits]]

[[jail-resource-limits]]

== Jail Resources Limits

== Jail Resource Limits

The syntax to limit the resources of a jail would be:

The syntax to limit the resources of a jail is as follows:

For example, to limit the maximum RAM that a jail can access run the following command:

For example, to limit the maximum RAM that a jail can access, run the following command:

[[jail-managers-and-container]]

[[jail-managers-and-containers]]

As previously explained, the different FreeBSD Jails can be created and configured manually.

As previously explained, each type of FreeBSD Jail can be created and configured manually, but FreeBSD also has third-party utilities to make configuration and administration easier.

But FreeBSD has some third-party utilities to make configuration and administration easier.