From nobody Sat Jan 4 17:20:47 2025 X-Original-To: freebsd-jail@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4YQS0128lhz5j3PN for ; Sat, 04 Jan 2025 17:21:05 +0000 (UTC) (envelope-from sl-pub-lists@honeyguide.de) Received: from mlx.honeyguide.net (mlx.honeyguide.net [197.155.21.76]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 4YQRzz0lGLz4mCv for ; Sat, 4 Jan 2025 17:21:03 +0000 (UTC) (envelope-from sl-pub-lists@honeyguide.de) Authentication-Results: mx1.freebsd.org; dkim=fail ("headers rsa verify failed") header.d=honeyguide.de header.s=default header.b=Ejl6Cqb0; spf=pass (mx1.freebsd.org: domain of sl-pub-lists@honeyguide.de designates 197.155.21.76 as permitted sender) smtp.mailfrom=sl-pub-lists@honeyguide.de; dmarc=pass (policy=none) header.from=honeyguide.de Received: from pcf00002.honeyguide.net (aftr-62-216-210-0.dynamic.mnet-online.de [62.216.210.0]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (prime256v1) server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by mlx.honeyguide.net (Postfix) with ESMTPSA id D37A218FE5; Sat, 04 Jan 2025 17:20:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=honeyguide.de; s=default; t=1736011253; bh=YG0CViurx+3gxmLYjBx4wBhfAjspg/2BHi08OlXBjUY=; h=From:To:Subject:In-Reply-To:References:Date; b=Ejl6Cqb0RkrU/szQfu0oXMMbDxFNjNfZ7/k8X7z7SBZRqJ9TXG8kW/pIWISwk20jk GJMir/3fMzdYzlAEAtbSUYMe4c7l9W+7YwLrTulomhKFULTd9NnppBm5vOtsUfiTcY XDLDLYK36Jv8pqoU/5qT5WkWrCr5cGqrpNhsHw7g= From: Stephan Lichtenauer To: "Dave Cottlehuber" , "JH Foo" , freebsd-jail Subject: Re: jail services in podman In-Reply-To: <0bea1d7c-7cf7-4faa-9b19-7fcc93ecb333@app.fastmail.com> (Dave Cottlehuber's message of "Sat, 04 Jan 2025 00:16:44 +0000") Organization: Honeyguide References: <9efebe67-e4e4-4919-bfdf-b7e29f4f0079@kungfoo.info> <0bea1d7c-7cf7-4faa-9b19-7fcc93ecb333@app.fastmail.com> Date: Sat, 04 Jan 2025 18:20:47 +0100 Message-ID: <86wmfaijgw.fsf@pcf00002.honeyguide.net> User-Agent: Gnus/5.13 (Gnus v5.13) List-Id: Discussion about FreeBSD jail(8) List-Archive: https://lists.freebsd.org/archives/freebsd-jail List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-jail@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; format=flowed X-Rspamd-Queue-Id: 4YQRzz0lGLz4mCv X-Spamd-Bar: -- X-Spamd-Result: default: False [-2.48 / 15.00]; NEURAL_HAM_LONG(-1.00)[-1.000]; NEURAL_HAM_SHORT(-1.00)[-0.997]; DMARC_POLICY_ALLOW_WITH_FAILURES(-0.50)[]; NEURAL_SPAM_MEDIUM(0.22)[0.222]; R_SPF_ALLOW(-0.20)[+mx]; MIME_GOOD(-0.10)[text/plain]; ONCE_RECEIVED(0.10)[]; ASN(0.00)[asn:37199, ipnet:197.155.16.0/21, country:ZA]; ARC_NA(0.00)[]; RCVD_VIA_SMTP_AUTH(0.00)[]; RCVD_COUNT_ONE(0.00)[1]; MIME_TRACE(0.00)[0:+]; HAS_ORG_HEADER(0.00)[]; RCVD_TLS_ALL(0.00)[]; MLMMJ_DEST(0.00)[freebsd-jail@freebsd.org]; FROM_EQ_ENVFROM(0.00)[]; FROM_HAS_DN(0.00)[]; RCPT_COUNT_THREE(0.00)[3]; R_DKIM_REJECT(0.00)[honeyguide.de:s=default]; DMARC_POLICY_ALLOW(0.00)[honeyguide.de,none]; TO_MATCH_ENVRCPT_SOME(0.00)[]; TO_DN_ALL(0.00)[]; DKIM_TRACE(0.00)[honeyguide.de:-] "Dave Cottlehuber" writes: > On Fri, 3 Jan 2025, at 19:42, JH Foo wrote: >> Can you elaborate how CMD helps to determine (quote) minimal >> dependencies are for each daemon or service? What happens if I >> were to > > If you run a normal startup with /etc/rc then that container > will > expect all the freebsd goodies - syslog, utx, cron, mailer, etc. > It will be more familiar but also fatter. > > If you manually trim down the dependencies, *and* your > application > permits it, you can choose just to run your minimal app. It will > require experimentation. > >> configure the container to run off jail /etc/rc.conf services? > > If you do that, no issues, *but* the container will exit as soon > as rc.conf > startup finished (as the ENTRYPOINT or CMD has completed). OCI > containers > are not the same as jails in this respect, by default. > Pot and Potluck has similar (even though not OCI compatible) capabilities. You can look at the *-nomad images at https://github.com/bsdpot/potluck to get an idea how jails without starting a fully fledged FreeBSD jail with rc can look like. Stephan