Jail

FreeBSD 从 4.0 版本开始提供了非常强大的虚拟化工具—-jail。对于许多应用来说，jail能够在确保应用程序之间的有效隔离的前提下，最大限度地发挥硬件性能（每个jail不会单独运行自己的内核），而在 jail 内部看来，则基本上与真正的服务器无异，且性能损失很小；通过内核提供的 ABI 模拟，jail能够提供 FreeBSD 早期版本，以及 Linux 2.4.x 或 2.6.x 的兼容能力。

许多传统的 Unix 应用程序假定系统中存在一个可用的 MTA。FreeBSD 中内建了 sendmail，但在 jail 中配置 sendmail 会遇到一个比较麻烦的问题，即在 jail 中，127.0.0.1 指代的是 jail 的 IP 地址而不是本地 loopback 设备。换言之，原本监听本地 socket 的 MTA 变成了监听 jail 对外的 IP，这会是一个安全隐患。

活动很有意思，今天的DevSummit峰会是在东大的电子工程系2号楼举行的。中午在东大的食堂吃饭，基本上是西式的午餐。

下午的会议主要是新近的一些专题。pjd@介绍了jail service，包括ZFS与jail之间的一些互动，等等。通过zfs提供的一些能力，我们能够让jail对更多的东西进行限制(例如磁盘空间，过去只能通过在vnode上面建FS这种土办法)，并且更像真的机器。之后是gnn老大长达近两小时的KSE code导读，比较遗憾的是，davidxu和很多其他重量级的threading hacker都没能参加这次会议。

Today I have submitted a PR which I have marked “critical”. bsd.port.mk does not do the right thing on RELENG_6 after the rcorder change, which will cause all ports installed rc.d scripts stop to function at system startup.

The PR can be accessed here: https://www.freebsd.org/cgi/query-pr.cgi?pr=93536

UPDATE(20060219): It seems that the problem is not related to this. I am still investigating what was happening.

UPDATE(20060220): Doug Barton has kindly provided information about the issue. It was because some nojail and mountcritlocal conflict. The issue can only appear when you are using jail(8).

Sometimes you may need to build some packages for older/newer versions of FreeBSD. That is simple if you use jail and other mechanisms.

In order to be successful, you need a “Full jail” say ordinary jail, installed with binary that is built from the target version of FreeBSD. For instance, build a 6.0 userland by sync’ing code to -HEAD.

Secondly, you need to replace two files in the jail: uname(1) and sysctl(1). What you have to do is to use sed to replace both FreeBSD version and __FreeBSDVersion (say, kern.osreldate), according to porters’ handbook.

I have finally got skeljail implemented through the RCng way. After some test I will post the patch for review.

A skel jail is a jail that share essential binaries/libraries with the base system (optionally, other base template if you want) through mount_nullfs.

tarsier的配置如下：

Pentium 4 3.0E
1G RAM
250G ATA * 2

tarsier将是我的第一个非职务管理的、同时又使用了jail service的FreeBSD服务器。tarsier上将采用我所提出的fast jail技术。

It seems that the official FreeBSD qmail port’s disable-qmail (as well as the Live with Qmail documentation) will need write access to /usr/bin and /usr/libexec, and hence the “fast jail” script I have written has been rendered useless :-(

I will investigate the issue this weekend and hopefully I will be able to work around the issue.

Today I start to build a package set for corporation’s production servers. However, perl 5.8 build was stopped with a strange error.

I went into investigating what is happening. Finally I found that I should have mount_devfs’ed before jailing the builder :-( What a shame…

Dag-Erling Smørgrav has posted a discussion on FreeBSD-arch (I have to use a outside link instead of FreeBSD’s own mailing list archive, because it didn’t updated from 2004-01-26 for unknown reason), accroding to this post, we see a need of running init(8) in jails, which allows us to terminate a jail cleanly.