Site Map - skip to main content

Hacker Public Radio

Your ideas, projects, opinions - podcasted.

New episodes every weekday Monday through Friday.
This page was generated by The HPR Robot at


hpr3168 :: FreeBSD Jails and iocage

Use iocage to manage freebsd jails

<< First, < Previous, , Latest >>

Hosted by norrist on 2020-09-23 is flagged as Clean and is released under a CC-BY-SA license.
BSD. 2.
The show is available on the Internet Archive at: https://archive.org/details/hpr3168

Listen in ogg, spx, or mp3 format. Play now:

Duration: 00:08:51

general.

FreeBSD Jails with iocage

Introduction

FreeBSD jails allow users to run multiple, isolated instances of FreeBSD on a single server. Iocage simplifies the management of FreeBSD Jails.

https://en.wikipedia.org/wiki/OS-level_virtualization

The jails will be configured to bind to an IP address on the jail host's internal network. The host OS will pass traffic from the external network to the jail.

The jails will be managed with Iocage. Iocage uses ZFS properties to store configuration data for each jail, so a ZFS file system is required.

Network setup

These steps will:

  1. Set up the internal network.
  2. Enable the pf packet filter
  3. Configure pf pass internet traffic to and from the jail.

PF is full featured firewall, and can do more than just pass traffic to an internal network. Refer to the PF documentation for additional configuration options.

Run the following to configure the internal network and enable pf.

sysrc cloned_interfaces+="lo1"
sysrc ifconfig_lo1="inet 192.0.2.1/24"
sysrc pf_enable="YES"

Put the following in /etc/pf.conf

# Variables
# ext_if should be set to the hosts external NIC
ext_if = "vtnet0"
jail_if = "lo1"
jail_net = $jail_if:network

# NAT allows the jails to access the external network
nat on $ext_if from $jail_net to any -> ($ext_if)

# Redirect traffic on port 80 to the web server jail
# Add similar rules for additional jails
rdr pass on $ext_if inet proto tcp to port 80 -> 192.0.2.10

Reboot to activate the network changes

ZFS

The best way to use ZFS on a VPS is to attach block storage as a new disk.

If block storage is not available, you can optionally use a file as the ZFS device.

Enable and start ZFS.

sysrc zfs_enable="YES"
service zfs start

ZFS using Block storage

List the available disks. If you are using a VPS, the block store will probably be the second disk.

geom disk list

Create a ZFS pool named jailstore.

zpool create jailstore  /dev/vtbd1

ZFS using a file

Create the ZFS file.

dd if=/dev/zero of=/zfsfile bs=1M count=4096

Create a ZFS pool named jailstore.

zpool create jailstore /zfsfile

Install iocage

pkg install py36-iocage

Using iocage

iocage activate jailstore
iocage fetch

iocage create -n www ip4_addr="lo1|192.0.2.10/24" -r 11.1-RELEASE
iocage start www
iocage console www

Once you have a shell inside the jail, install and start Apache.

pkg install apache24
sysrc apache24_enable="yes"
service apache24 start

Port 80 on the jail will now be accessible on the hosts IP address.

Multiple jails.

Additional jails can be installed using the example above.

  1. Install the new jail with the iocage create command , but use a different IP address
  2. Expose the new jail to the network by adding additional rules to pf.conf.

Book recommendation


Comments

Subscribe to the comments RSS feed.

Comment #1 posted on 2020-09-27 21:56:16 by 0xf10e

Why an additional disk/zpool?

Hi norrist,

why do you recommend a 2nd disk with a new pool to use for iocage? Using iocage on the host's root(fs) pool works just fine. If I had spare disk (or even cheap storage for a VPS) I would rather use it to mirror my system including the iocage dataset.

Regards, 0xf10e

Comment #2 posted on 2020-09-28 21:32:33 by norrist

2nd disk for iocage

A second disk is not an absolute requirement if you are already using ZFS on root. I made the recommendation for a second disk because some VPS providers still default to UFS for the root partition.

Thanks to 0xf10e for the feedback

Leave Comment

Note to Verbose Commenters
If you can't fit everything you want to say in the comment below then you really should record a response show instead.

Note to Spammers
All comments are moderated. All links are checked by humans. We strip out all html. Feel free to record a show about yourself, or your industry, or any other topic we may find interesting. We also check shows for spam :).

Provide feedback
Your Name/Handle:
Title:
Comment:
Anti Spam Question: What does the letter P in HPR stand for?
Are you a spammer?
What is the HOST_ID for the host of this show?
What does HPR mean to you?