Jails
A dedicated machine for a server is a costly thing. For a server which is not often used, it is desirable to still be able to use the same machine, but without the drawbacks of having all the servers on one installation. These are sometimes limited via chrooted servers. A better way is with the help of a jail.
NOTE: This was written in 2007, its now 2012 and a lot things have changed since 2007. There is now a port system utility called qjail which greatly simplifies jail creation and administration.
Full details can be found on the
qjail project website.
Creating a jail [manual method]
Install cpdup ({PORTSDIR}/sysutils/cpdup)
# pkg_add -r cpdup
Alternatively if that doesn't work try:
# cd {PORTSDIR}/sysutils/cpdup && make install clean
Next create a template:
# mkdir /usr/jail /usr/jail/mroot # cd /usr/src # make installworld DESTDIR=/usr/jail/mroot # cpdup /usr/src /usr/jail/mroot/usr/src
# mkdir /usr/jail/skel /usr/jail/skel/home /usr/jail/skel/distfiles # cd /usr/jail/mroot # mv etc /usr/jail/skel # mv usr/local /usr/jail/skel/usr-local # mv tmp /usr/jail/skel # mv var /usr/jail/skel # mv root /usr/jail/skel # mergemaster -t /usr/jail/skel/var/tmp/temproot -D /usr/jail/skel -i # cd /usr/jail/skel # rm -R bin boot lib libexec mnt proc rescue sbin sys usr dev # cd /usr/jail/mroot # mkdir usr/ports # mkdir s # ln -s s/etc etc # ln -s s/home home # ln -s s/root root # ln -s ../s/usr-local usr/local # ln -s ../s/usr-local usr/X11R6 # ln -s ../../s/distfiles usr/ports/distfiles # ln -s s/tmp tmp # ln -s s/var var
Edit /etc/rc.conf:
jail_enable="YES" jail_set_hostname_allow="NO" jail_list="{server1} {server2}" jail_devfs_enable="YES"
Search man 5 rc.conf for more jail settings If you would like to have some standard configuration settings for (almost) all jails modify the files in /usr/jail/skel. (e.g. /etc/resolve.conf) In /etc/rc.conf set
rpcbind_enable="NO"
Create a jail skeleton
# mkdir /usr/jails
For every server:
- Edit /etc/fstab on your host system:
/usr/jail/mroot /usr/jail/{server} nullfs ro 0 0 /usr/jails/{server} /usr/jail/{server}/s nullfs rw 0 0
- Create the mount-points
- mkdir /usr/jail/{server}
- cpdup /usr/jail/skel /usr/jails/{server}
- Edit /etc/rc.conf:
jail_{server}_hostname="server.example.org" jail_{server}_ip="192.168.x.x" jail_{server}_rootdir="/usr/jail/{server}"
Finally mount the jails and start them.
# mount -a # /etc/rc.d/jail start
They should be running now and you should be able to see them by typing:
jls
If you wish to access the system type:
jexec tcsh {JID}
One often creates a build jail in which one creates the packages for the separate jails creating less "pollution" in your jails. One can now install the packages for the jail.
For more information see:
man 8 jail