FreeBSD's Jails doesnt allow raw socket access by default since i have been using it (~10Y) and probably even much longer.
edit: Since 2004 to be precise.
https://www.freebsd.org/releases/5.3R/relnotes-amd64.html
So well documented. Gotta love it.
edit: Since 2004 to be precise.
https://www.freebsd.org/releases/5.3R/relnotes-amd64.html
So well documented. Gotta love it.
It sounds like the Docker folks aren't thrilled with enabling raw sockets by default, but enough people expect outbound ping to work.
(Linux's network stack does have an unprivileged ping, controlled by setting sysctl net.ipv4.ping_group_range appropriately; recent ping binaries support using it but I think most distros don't enable the sysctl. I'm guessing Docker could enable it within containers if they weren't worried about older distros that predate this support in ping.)
a) I didn't need much separation, I just wanted to run multiple environments on one box to save hardware; in this case, I enabled raw sockets, because it was convenient to ssh into the virtual environment and ping things.
b) things that I wanted really separate; for these environments, I left raw sockets disabled, the jail only contains the one executable (statically compiled); additionally, I also setup ipfw rules to prevent IP traffic from the jail from getting in or out, other than the specific things it was intended to do.
Not familiar with freeBSD jails.
Jails doesn't have any of the deployment, tools for creating images, building of images, registry for images etc. Docker also automates a lot of networking stuff away whereas with jails I usually have to use something like PF to set up port forwards; I also sometimes run into problems with the fact it shares the network stack with the host.
That being said, all the configuration is quite simple and building exactly what I need for running an application isn't too difficult. The big advantage after that being that I understand how everything is wired together and I can debug easier when something goes wrong. Doing it manually however takes up much more time.