Neirac cneira

How to jail a single process web server on FreeBSD 12.1

You may have found many great resources on how to set up jails on latest FreeBSD, however there is scant information on how to go about creating a barebones jail with nothing but the one process that you want to isolate.

I was curious if I could contain a statically compiled web server that I wrote while learning Rust all by itself in a jail instead of having a full userland.

A minor list of how to create and boot a Bhyve-zone in Joyent SmartOS

cd /opt/local/artifacts/
vim zonemanifestBhyveFreeBSD.json
vmadm create < zonemanifestBhyveFreeBSD.json
curl -kLo /zones/UUID/root/FreeBSD-12.0-RC3-amd64-bootonly.iso

The following line is for KVM, not BHYVE, hence obsoleted for non-legacy boot options

cd /zones/<<UUID>>/root/

These are bare-bones instructions for creating a Windows image for bhyve on SmartOS. You will need a platform image that has the fix for OS-7117. Platform images that I've used in testing are here: iso tgz usb

Create a volume that will be the disk.

zfs create -o volblocksize=4k -V 16g -s zones/hdd-windows

This script will be used for booting from the CD.

Introduction

The following options that aren't in the kvm brand should work:

com1, com2
- Can be set to tty-like devices or socket,/some/path.
- If both are unset, com1 defaults to /dev/zconsole and com2 defaults to /tmp/vm.ttyb.
bootrom
- Should be set to /usr/share/bhyve/BHYVE_UEFI.fd or /usr/share/bhyve/BHYVE_UEFI_CSM.fd
Defaults to /usr/share/bhyve/BHYVE_UEFI_CSM.fd

This is an outdated draft that was used to review the content with FreeBSD contributors. For the latest revision, vist http://shawndebnath.com/articles/2016/03/27/freebsd-jails-with-vlan-howto.html.

FreeBSD Jails with VLAN HOWTO

This article discusses how to set up jails on a FreeBSD 11-CURRENT system utilizing VIMAGE (aka VNET) to provide a virtualized independent network stack for each jail with support for VLAN tagging.

Prerequisites

SmartOS Zone Manipulation

Notes on snapshots, images, and migrations

Create Zone/KVM

# Create zone
vmadm create <<EOL
{
 "brand": "joyent",
 .

	{
	"acpi" : "on",
	"autoboot" : "false",
	"bootargs" : "",
	"bootorder" : "cd",
	"cdrom" : "/zones/iso/FreeBSD-12.1-RELEASE-amd64-disc1.iso",
	"bootdisk" : {
	"blocksize" : "8K",
	"path" : "rpool/bsd1",
	"size" : "20G",

	# Licensed under CC BY 3.0 http://creativecommons.org/licenses/by/3.0/
	# Derived works must attribute https://gist.github.com/4492300 at the beginning, and the date.

	##################################################################
	Installing and Configuring SmartOS at Hetzner (with a /29)
	##################################################################

	# This is another version of Jahewson's Gist here: https://gist.github.com/jahewson/4492300 that adds a gate to prevent packets
	from leaking out from the main MAC address.

	Adding a new disk to a bhyve vm takes a few steps.

	1. increase the quota on the zfs dataset to accomodate the additional
	space.
	2. create a zvol inside the zone
	3. stop the vm and update its configuration to reflect the change
	4. start the vm, login and use the disk

	# update quota

	# Licensed under CC BY 3.0 http://creativecommons.org/licenses/by/3.0/
	# Derived works must attribute https://gist.github.com/4492300 at the beginning, and the date.

	##################################################################
	Installing and Configuring SmartOS on a budget server (with a /29)
	##################################################################

	# if you find this gist useful, please star it

	# please be aware that budget hosting companies usually cut corners somewhere,