Gnu Group Learning AcademyGnu Group ↗
FreeBSD Fundamentals · Module 09 of 14

Jails and workload isolation

Understand FreeBSD jails, create a basic jail and reason about host/jail boundaries before advanced VNET designs.

Learning objectives

By the end of this module, you should be able to:

  • Explain how jails isolate processes and filesystem views.
  • Create and enter a basic jail in a lab.
  • Distinguish host administration from jail administration.

Jails extend chroot with stronger OS-level isolation

Jails provide a separate process namespace, hostname context and constrained system view while sharing the FreeBSD kernel. They are an operating-system isolation primitive, not virtual machines.

Networking models

Simple jails can share host networking in constrained ways; VNET jails can receive their own network stack and interfaces. Fundamentals should master lifecycle and boundaries before advanced topologies.

Worked examples

See the idea in practice.

Inspect jails

jls
service jail status || true
  • jls shows active jail state.
Hands-on lab

Lab — Provision, enter and stop a classic jail

Goal: Build a matching-release jail userland, configure it, start it, enter it with jexec, prove isolation, stop it and clean up.

Before you start

  • Disposable FreeBSD VM with Internet access and enough disk space.
  • The jail userland must not be newer than the host. This lab derives the host RELEASE before downloading base.txz.
STEP 1

Derive host release and prepare jail directories

RELEASE=$(freebsd-version -u | sed -E 's/-p[0-9]+$//')
ARCH=$(uname -m)
echo "$RELEASE"
echo "$ARCH"
mkdir -p /usr/local/jails/media
mkdir -p /usr/local/jails/containers/academyjail
mkdir -p /etc/jail.conf.d
STEP 2

Download and extract matching base userland

fetch -o "/usr/local/jails/media/${RELEASE}-base.txz" \
  "https://download.freebsd.org/releases/${ARCH}/${ARCH}/${RELEASE}/base.txz"
ls -lh "/usr/local/jails/media/${RELEASE}-base.txz"
tar -xf "/usr/local/jails/media/${RELEASE}-base.txz" \
  -C /usr/local/jails/containers/academyjail --unlink
ls /usr/local/jails/containers/academyjail
STEP 3

Provide basic resolver/time configuration

cp /etc/resolv.conf /usr/local/jails/containers/academyjail/etc/resolv.conf
test -f /etc/localtime && cp /etc/localtime /usr/local/jails/containers/academyjail/etc/localtime || true
STEP 4

Create the jail configuration

cat > /etc/jail.conf.d/academyjail.conf <<'EOF'
academyjail {
    host.hostname = "academyjail";
    path = "/usr/local/jails/containers/academyjail";
    exec.clean;
    mount.devfs;
    ip4 = inherit;
    exec.start = "/bin/sh /etc/rc";
    exec.stop  = "/bin/sh /etc/rc.shutdown";
}
EOF
cat /etc/jail.conf.d/academyjail.conf
STEP 5

Start and inspect the jail

jls
service jail onestart academyjail
jls
STEP 6

Enter the jail and prove the boundary

jexec academyjail /bin/sh
# Inside the jail run:
hostname
id
freebsd-version
echo "GNU Group jail validation" > /tmp/academy.txt
cat /tmp/academy.txt
# Then exit the jail shell.
STEP 7

Verify from the host and execute directly

cat /usr/local/jails/containers/academyjail/tmp/academy.txt
jexec academyjail hostname
jexec academyjail id
jexec academyjail freebsd-version
STEP 8

Stop and clean up

service jail onestop academyjail
jls
mount | grep academyjail || true
rm -f /etc/jail.conf.d/academyjail.conf
rm -rf /usr/local/jails/containers/academyjail
rm -f "/usr/local/jails/media/${RELEASE}-base.txz"

Verify

  • jls shows academyjail after start and no academyjail after stop.
  • jexec runs hostname, identity and release commands inside the jail.
  • A file created inside /tmp in the jail is visible at the corresponding jail-root path on the host.

Expected outcome

  • A matching-release classic jail completes create → configure → start → enter → stop → cleanup successfully.
  • No VNET or host firewall changes are required for this fundamentals lifecycle lab.

If it fails

  • If the release archive URL fails, confirm RELEASE and ARCH output against the installed host before changing the URL.
  • If the jail does not stop cleanly or devfs remains mounted, inspect jls and mount output before deleting the jail root.
Real-world connection

A credible jail lesson must exercise the lifecycle and host/jail boundary, not merely create directories or discuss syntax.

Avoid these traps

Common mistakes

  • Treating a jail as a full hardware-virtualized VM.
  • Copying old jail provisioning commands without checking release-specific guidance.
Knowledge check

Can you explain it without looking back?

Open each answer only after you have tried to answer the question yourself.

1Do jails boot a separate kernel?

No. Jails share the host FreeBSD kernel while isolating userspace views and resources.

2What command lists running jails?

jls.

3What is VNET?

A jail networking mode that gives the jail its own virtual network stack and interfaces.

My Learning

Record your progress for this module.

Progress is saved in this browser immediately. When you sign in to My Learning, it can also sync across devices.

Not started

Attempt the core lab and knowledge checks before marking the module complete.