From owner-freebsd-questions@freebsd.org Mon Aug 15 18:58:46 2016 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 98BB4BBA250 for ; Mon, 15 Aug 2016 18:58:46 +0000 (UTC) (envelope-from sergeig.public@gmail.com) Received: from mail-ua0-x22b.google.com (mail-ua0-x22b.google.com [IPv6:2607:f8b0:400c:c08::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 59370128C for ; Mon, 15 Aug 2016 18:58:46 +0000 (UTC) (envelope-from sergeig.public@gmail.com) Received: by mail-ua0-x22b.google.com with SMTP id n59so87010554uan.2 for ; Mon, 15 Aug 2016 11:58:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:from:date:message-id:subject:to; bh=M8ecDjvAB2sTQ6T+vB5KOxBVnS3dJH6N1HkLb3uDkSE=; b=QwP8F8wIy4H+2i87UtwMmhPILejp4W8wxnULKmzC264IKSJ6wAj00O9PFay2Jhr0mC Gphsg7XbF0G0PkOauY9KrmNiZDNs6h1KnOwk4lLzJ+HNy0Z1bq0I8yFQWRQx54Mxw1ps 377LF/CwqsRW9yThLV0KIBRdZzc/C/+o4XsXjRW8yOq1k36yakrBWK/Fp2/PY9TKEu/u UvESl2ZOcp2usihv/1lfQkLemb1aHjs8Kzp3ZVHKACA/8ry+84HcLbw1lxsyUydyn9P1 g6iYuuwVdjnd3zLphcoVVasACLk3xL4azCdK2wRY+cDEECYumK3s8MEA0qCJPWsdEP6U lnNQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=M8ecDjvAB2sTQ6T+vB5KOxBVnS3dJH6N1HkLb3uDkSE=; b=TMF94YVx850HZzeu9BqkYtAi1cG+U0lNKVyPnYm3RGy/l20Lrvfsnq5PlRj3ZHz+G/ eqEfxwSraqiv1h0sxcNgRx33ISLaCGpTegvAJ21bv3N9VcKUjKfWFbIYSTngzCnDpqbW lRUiTYaAulAkXNXVnFa4EqaI747ozZnRZzs6gw5PF3J5wPFtGGcEJUIsNSaxLwAUP7nV ixTiXO5UF8uYQ900A5rUlxFZBH9S4FAHdBf9PFEy+pLezZa1y88o4F2hmAk+lV8vPWJL 8L+uOoGCsjTOtdoQOYslWj6pQQDA4Jl69/gYzT6yMUhDsHbGK2yqJue/y4OLo/bcAglw kZaQ== X-Gm-Message-State: AEkoouv6iNzlG/6Y+7GyJhYgXtL/tohxnJRsWyp6ZLvClNGHEOJptKKovMQy7f8QehsudYq2BN5Ik68BANK4cg== X-Received: by 10.159.37.139 with SMTP id 11mr2206247uaf.45.1471287525205; Mon, 15 Aug 2016 11:58:45 -0700 (PDT) MIME-Version: 1.0 Received: by 10.103.9.129 with HTTP; Mon, 15 Aug 2016 11:58:44 -0700 (PDT) From: Sergei G Date: Mon, 15 Aug 2016 11:58:44 -0700 Message-ID: Subject: isolation of GO lang application (jail and chroot) To: FreeBSD Questions Content-Type: text/plain; charset=UTF-8 X-Content-Filtered-By: Mailman/MimeDel 2.1.22 X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Aug 2016 18:58:46 -0000 Hi, I have a small web application (using GO language) that I wrote and need to run as a daemon. I would love to expose it to Internet in a safe and secure way. I know I can load a jail (I use qjail) and load application that way. I will then forward requests from nginx to the tail. That's what I typically do. The jail is a mini copy of operating system with application running inside of it. I'd like to lighten the configuration effort. chroot comes to mind, but I have not done that. Do I have to code chroot as a system call from inside my GO language application? Or can I chroot just like I do jails? Can I jail just a single process without setting up a copy of operating system? That's what ideally I would like to do. My application does open a TCP/IP socket for serving data and works with local file system. Do you have any recommendation? Thank you