Hacker News Reader

Hacker News

Comment by doublerabbit | Hacker News Reader

Parent Full thread

doublerabbit

Not op, but for me:

You can setup Linux in a jail.

You can nest bhyve virtual machines in a jail.

You can assign individual NICs to a jail.

You can encrypt with ZFS a jail.

You can run browsers in a jail with full set of features.

View on HN

Most of those are supported by "containers", which are after all just a chroot and a process tree with restricted visibility into certain kernel objects. Assigning individual NICs or running a browser with extra isolation is one of the classic Linux namespace tutorials.

  > You can setup Linux in a jail.

I don't see how this can be possible. Could you explain more how to boot a Linux kernel within a FreeBSD jail?

edit: I'm not talking about running binaries compiled for Linux under FreeBSD. The parent said it's possible to set up Linux within a jail, so I want to see instructions to boot an actual Linux kernel as a FreeBSD process.

You use FreeBSD kernel and Linux userland. FreeBSD can emulate Linux system calls.

There is no such thing as “Linux userland”. Obviously you can port most GNU utilities and other things that are typically run on Linux on FreeBSD but that’s a far cry from “running Linux”.

Using the linuxulator.

https://wiki.freebsd.org/LinuxJails

> Assigning individual NICs or running a browser with extra isolation is one of the classic Linux namespace tutorials.

With FreeBSD you can set up a standalone virtualized network stack:

* https://klarasystems.com/articles/virtualize-your-network-on...

* https://man.freebsd.org/cgi/man.cgi?vnet

* https://wiki.freebsd.org/Jails/VNET

I read the quote you're replying to as "you can also do this under linux", i.e. it didn't dispute that freebsd jails can do it. But it's not a distinguishing feature of jails.

You could maybe build and run User-Mode Linux on FreeBSD, and run that in a jail. That's pretty close to your own interpretation of "Linux kernel in a jail"

But to be real: that's obviously not what was meant. If someone wants to install and run Ubuntu inside a FreeBSD jail, it is well possible to do that. Nobody really cares if it's running kernel.org code, just that the binaries are running as expected.

All of those available on Linux and even more, see https://www.man7.org/linux/man-pages/man1/systemd-nspawn.1.h...

I don't see the guide to run FreeBSD in a container from that man page.

And what about if my Linux Distro doesn't use system-md, like Slackware.

> And what about if my Linux Distro doesn't use system-md, like Slackware.

It's a choice of Slackware not use systemd infra. However on Linuxes you have more that one choice to run containers, your next option would be LXC/LDX https://docs.slackware.com/howtos:misc:lxc

Sure and my choice not to use it too. Well aware of LXC too.

I'm not claiming Linux can't. I was stating why. I know Linux can do what FreeBSD can do, but BSD does it better.

However both are pretty much mimicked concept from Solaris Zones

> However both are pretty much mimicked concept from Solaris Zones

Your timeline is off.

FreeBSD and Linux were within a year of each other (not in-tree on linux, but Debian packaged VServer kernels and VServer + GRSec kernels; we used vserver+grsec debian packaged kernels at work in the mid through late '00s).

Solaris containers came years later.

2000 - FreeBSD jails

2001 - Linux VServer

2004 - Solaris Containers

https://blog.aquasec.com/a-brief-history-of-containers-from-...

I wonder why would anyone spend time on developing and maintaining that. FreeBSD needs Linux userland and syscall support to get roughly the same level of software compatibility. The opposite isn't true (maybe it is for your special snowlake internal application developed specifically for FreeBSD, but it isn't so in general case).

All other things you have mentioned are possible with pretty much any of the Linux container runtimes. systemd-nspawn is just one of them, and I don't think it is actually used very much compared to the alternatives.

Reply on news.ycombinator.com