git: 093e79e3b3 - main - Handbook - Jails: Improvements, fix typos
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Wed, 20 Sep 2023 18:14:12 UTC
The branch main has been updated by carlavilla:
URL: https://cgit.FreeBSD.org/doc/commit/?id=093e79e3b3016943d38a9b6b0c0909a2d37631e1
commit 093e79e3b3016943d38a9b6b0c0909a2d37631e1
Author: Benjamin Spiegel <bspiegel100@gmail.com>
AuthorDate: 2023-09-20 18:13:46 +0000
Commit: Sergio Carlavilla Delgado <carlavilla@FreeBSD.org>
CommitDate: 2023-09-20 18:13:46 +0000
Handbook - Jails: Improvements, fix typos
PR: 273983
---
.../content/en/books/handbook/jails/_index.adoc | 204 +++++++++++----------
1 file changed, 103 insertions(+), 101 deletions(-)
diff --git a/documentation/content/en/books/handbook/jails/_index.adoc b/documentation/content/en/books/handbook/jails/_index.adoc
index ef25ed2581..ccae77a0af 100644
--- a/documentation/content/en/books/handbook/jails/_index.adoc
+++ b/documentation/content/en/books/handbook/jails/_index.adoc
@@ -76,27 +76,27 @@ Jails can be considered as a type of operating system-level virtualization.
This chapter covers:
* What a jail is and what purpose it may serve in FreeBSD installations.
-* The different type of jails.
-* The different way to configure the network for a jail.
+* The different types of jail.
+* The different ways to configure the network for a jail.
* The jail configuration file.
-* How to create the different types of jails.
-* How to start, stop and restart a jail.
+* How to create the different types of jail.
+* How to start, stop, and restart a jail.
* The basics of jail administration, both from inside and outside the jail.
-* How to upgrade the different types of jails.
+* How to upgrade the different types of jail.
* A incomplete list of the different FreeBSD jail managers.
[[jail-types]]
-== Jail types
+== Jail Types
Some administrators divide jails into different types, although the underlying technology is the same.
Each administrator will have to assess what type of jail to create in each case depending on the problem they have to solve.
-Below can be found a list of the different types, their characteristics, etc.
+Below can be found a list of the different types, their characteristics, and considerations for use.
[[thick-jails]]
=== Thick Jails
-A thick jail is a more traditional form of FreeBSD Jail.
+A thick jail is a traditional form of FreeBSD Jail.
In a thick jail, a complete copy of the base system is replicated within the jail's environment.
This means that the jail has its own separate instance of the FreeBSD base system, including libraries, executables, and configuration files.
The jail can be thought of as an almost complete standalone FreeBSD installation, but running within the confines of the host system.
@@ -110,7 +110,7 @@ Advantages of Thick Jails:
Disadvantages of Thick Jails:
-* Resource overhead: Because each jail maintains its own separate base system, it consumes more resources compared to thin jails.
+* Resource overhead: Because each jail maintains its own separate base system, thick jails consume more resources compared to thin jails.
* Maintenance: Each jail requires its own maintenance and updates for its base system components.
[[thin-jails]]
@@ -121,13 +121,13 @@ Only a minimal subset of base system is duplicated for each thin jail, resulting
However, this also means that thin jails have less isolation and independence compared to thick jails.
Changes in shared components could potentially affect multiple thin jails simultaneously.
-In summary, a FreeBSD Thick Jail is a type of FreeBSD Jail that replicates a substantial portion of the base system within the isolated environment.
+In summary, a FreeBSD Thin Jail is a type of FreeBSD Jail that replicates a substantial portion, but not all, of the base system within the isolated environment.
Advantages of Thin Jails:
* Resource Efficiency: Thin jails are more resource-efficient compared to thick jails. Since they share most of the base system, they consume less disk space and memory. This makes it possible to run more jails on the same hardware without consuming excessive resources.
* Faster Deployment: Creating and launching thin jails is generally faster compared to thick jails. This can be particularly advantageous when you need to rapidly deploy multiple instances.
-* Unified Maintenance: Since thin jails share the majority of their base system with the host system, updates and maintenance of common base system components (such as libraries and binaries) only need to be done once on the host. This simplifies the maintenance process compared to maintaining individual base system for each thick jail.
+* Unified Maintenance: Since thin jails share the majority of their base system with the host system, updates and maintenance of common base system components (such as libraries and binaries) only need to be done once on the host. This simplifies the maintenance process compared to maintaining an individual base system for each thick jail.
* Shared Resources: Thin jails can more easily share common resources such as libraries and binaries with the host system. This can potentially lead to more efficient disk caching and improved performance for applications within the jail.
Disadvantages of Thin Jails:
@@ -157,21 +157,21 @@ The purpose of a Linux Jail is to facilitate the execution of Linux software on
[[host-configuration]]
== Host Configuration
-Before creating any jail on the host system it is necessary to perform certain configurations and obtain some information from the host system.
+Before creating any jail on the host system it is necessary to perform certain configuration and obtain some information from the host system.
-It will be necessary to configure the man:jail[8] utility, create the necessary directories to configure and install the jails, obtain information from the host's network and check if the host uses OpenZFS or UFS as file system.
+It will be necessary to configure the man:jail[8] utility, create the necessary directories to configure and install jails, obtain information from the host's network, and check whether the host uses OpenZFS or UFS as its file system.
[TIP]
====
-The FreeBSD version running in the jail can not be newer that the version running in the host
+The FreeBSD version running in the jail can not be newer that the version running in the host.
====
-[[host-configuration-jail-Utility]]
+[[host-configuration-jail-utility]]
=== Jail Utility
The man:jail[8] utility manages jails.
-To start the jails when the system boots, run the following commands:
+To start jails when the system boots, run the following commands:
[source,shell]
....
@@ -181,7 +181,7 @@ To start the jails when the system boots, run the following commands:
[TIP]
====
-With `jail_parallel_start` all configured jails will be started in the background.
+With `jail_parallel_start`, all configured jails will be started in the background.
====
[[jails-networking]]
@@ -204,7 +204,7 @@ man:netgraph[4] is a versatile kernel framework for creating custom network conf
It can be used to define how network traffic flows between jails and the host system and between different jails.
[[host-configuration-directories]]
-=== Setting up the Jail Directory Tree
+=== Setting Up the Jail Directory Tree
There is no specific place to put the files for the jails.
@@ -217,7 +217,7 @@ Apart from [.filename]#/usr/local/jails# other directories will be created:
* [.filename]#templates# will contain the templates when using Thin Jails.
* [.filename]#containers# will contain the jails.
-When using OpenZFS, execute the following commands to create the dataset:
+When using OpenZFS, execute the following commands to create datasets for these directories:
[source,shell]
....
@@ -245,7 +245,7 @@ When using UFS, execute the following commands to create the directories:
[[jail-configuration-files]]
=== Jail Configuration Files
-There are two ways to configure the jails.
+There are two ways to configure jails.
The first one is to add an entry for each jail to the file [.filename]#/etc/jail.conf#.
The other option is to create a file for each jail in the directory [.filename]#/etc/jail.conf.d/#.
@@ -286,13 +286,13 @@ jailname { <.>
<.> `exec.start` - Command(s) to run in the jail environment when a jail is created. A typical command to run is "/bin/sh /etc/rc".
<.> `exec.stop` - Command(s) to run in the jail environment before a jail is removed. A typical command to run is "/bin/sh /etc/rc.shutdown".
<.> `exec.consolelog` - A file to direct command output (stdout and stderr) to.
-<.> `allow.raw_sockets` - Allow to create raw sockets. Setting this parameter allows utilities like man:ping[8] and man:traceroute[8] to operate inside the jail.
+<.> `allow.raw_sockets` - Allow creating raw sockets inside the jail. Setting this parameter allows utilities like man:ping[8] and man:traceroute[8] to operate inside the jail.
<.> `exec.clean` - Run commands in a clean environment.
<.> `mount.devfs` - Mount a man:devfs[5] filesystem on the chrooted [.filename]#/dev# directory, and apply the ruleset in the devfs_ruleset parameter to restrict the devices visible inside the jail.
<.> `host.hostname` - The hostname of the jail.
-<.> `path` - The directory which is to be the root of the jail. Any commands run inside the jail, either by jail or from man:jexec[8], are run from this directory.
-<.> `ip4.addr` - IPv4 address. There are two configuration possibilities for IPv4, the first is to establish an IP or a list of IPs as has been done in the example. The other is to use `ip4` instead and set the `inherit` value to inherit the host's IP address.
-<.> `ip6.addr` - IPv6 address. There are two configuration possibilities for IPv6, the first is to establish an IP or a list of IPs as has been done in the example. The other is to use `ip6` instead and set the `inherit` value to inherit the host's IP address.
+<.> `path` - The directory which is to be the root of the jail. Any commands that are run inside the jail, either by jail or from man:jexec[8], are run from this directory.
+<.> `ip4.addr` - IPv4 address. There are two configuration possibilities for IPv4. The first is to establish an IP or a list of IPs as has been done in the example. The other is to use `ip4` instead and set the `inherit` value to inherit the host's IP address.
+<.> `ip6.addr` - IPv6 address. There are two configuration possibilities for IPv6. The first is to establish an IP or a list of IPs as has been done in the example. The other is to use `ip6` instead and set the `inherit` value to inherit the host's IP address.
<.> `interface` - A network interface to add the jail's IP addresses. Usually the host interface.
More information about configuration variables can be found in man:jail[8] and man:jail.conf[5].
@@ -306,7 +306,7 @@ They can be managed more or less like a normal host system and updated independe
[[creating-classic-jail]]
=== Creating a Classic Jail
-In principle, a jail only needs a hostname, a root directory, an IP address and a userland.
+In principle, a jail only needs a hostname, a root directory, an IP address, and a userland.
The userland for the jail can be obtained from the official FreeBSD download servers.
@@ -317,9 +317,9 @@ Execute the following command to download the userland:
# fetch https://download.freebsd.org/ftp/releases/amd64/amd64/13.2-RELEASE/base.txz -o /usr/local/jails/media/13.2-RELEASE-base.txz
....
-Once the download is complete it will be necessary to extract the contents into the jail directory.
+Once the download is complete, it will be necessary to extract the contents into the jail directory.
-Execute the following commands to extract the userland into jail's directory:
+Execute the following commands to extract the userland into the jail's directory:
[source,shell]
....
@@ -327,7 +327,7 @@ Execute the following commands to extract the userland into jail's directory:
# tar -xf /usr/local/jails/media/13.2-RELEASE-base.txz -C /usr/local/jails/containers/classic --unlink
....
-With the userland extracted in the jail directory, will be necessary to copy the timezone and the DNS servers files:
+With the userland extracted in the jail directory, it will be necessary to copy the timezone and DNS server files:
[source,shell]
....
@@ -335,15 +335,15 @@ With the userland extracted in the jail directory, will be necessary to copy the
# cp /etc/localtime /usr/local/jails/containers/classic/etc/localtime
....
-With the files moved the next thing to do is update to the latest patch level executing the following command:
+With the files copied, the next thing to do is update to the latest patch level by executing the following command:
[source,shell]
....
# freebsd-update -b /usr/local/jails/containers/classic/ fetch install
....
-The last step will be to configure it.
-It will be necessary to add an entry to the configuration file [.filename]#/etc/jail.conf# or in [.filename]#jail.conf.d# with the data of the jail.
+The last step is to configure the jail.
+It will be necessary to add an entry to the configuration file [.filename]#/etc/jail.conf# or in [.filename]#jail.conf.d# with the parameters of the jail.
An example would be the following:
@@ -370,7 +370,7 @@ classic {
}
....
-And then execute the following command to start the jail:
+Execute the following command to start the jail:
[source,shell]
....
@@ -382,21 +382,22 @@ More information on how to manage jails can be found in the section <<jail-manag
[[thin-jail]]
== Thin Jails
-Although the Thin Jails use the same technology, the creation is different.
+Although Thin Jails use the same technology as Thick Jails, the creation procedure is different.
Thin jails can be created using OpenZFS snapshots or using templates and NullFS.
The use of OpenZFS snapshots and templates using NullFS have certain advantages over classic jails,
such as being able to create them faster from snapshots or being able to update multiple jails using NullFS.
[[creating-thin-jail-openzfs-snapshots]]
-=== Creating a Thin Jail using OpenZFS Snapshots
+=== Creating a Thin Jail Using OpenZFS Snapshots
Due to the good integration between FreeBSD and OpenZFS it is very easy to create new Thin Jails using OpenZFS Snapshots.
-To create a Thin Jail using OpenZFS Snapshots the first step will be to create a template.
+To create a Thin Jail using OpenZFS Snapshots the first step is to create a template.
-The templates will only be used to create new jails, for this reason they are created in "read-only" mode, in order to create jails easily with an immutable base.
+Templates will only be used to create new jails.
+For this reason they are created in "read-only" mode so that jails are created with an immutable base.
-To create the dataset to save the template execute the following command:
+To create the dataset for the template, execute the following command:
[source,shell]
....
@@ -410,14 +411,14 @@ Then execute the following command to download the userland:
# fetch https://download.freebsd.org/ftp/releases/amd64/amd64/13.2-RELEASE/base.txz -o /usr/local/jails/media/13.2-RELEASE-base.txz
....
-Once the download is complete it will be necessary to extract the contents in the template directory executing the following command:
+Once the download is complete, it will be necessary to extract the contents in the template directory by executing the following command:
[source,shell]
....
# tar -xf /usr/local/jails/media/13.2-RELEASE-base.txz -C /usr/local/jails/templates/13.2-RELEASE --unlink
....
-With the userland extracted in the templates directory, it will be necessary to copy the timezone and the DNS servers files to the template directory executing the following command:
+With the userland extracted in the templates directory, it will be necessary to copy the timezone and DNS server files to the template directory by executing the following command:
[source,shell]
....
@@ -425,33 +426,33 @@ With the userland extracted in the templates directory, it will be necessary to
# cp /etc/localtime /usr/local/jails/templates/13.2-RELEASE/etc/localtime
....
-The next thing to do is update to the latest patch level executing the following command:
+The next thing to do is update to the latest patch level by executing the following command:
[source,shell]
....
# freebsd-update -b /usr/local/jails/templates/13.2-RELEASE/ fetch install
....
-Once the update is finished the template will be ready.
+Once the update is finished, the template is ready.
-To create the OpenZFS Snapshot from the template execute the following command:
+To create an OpenZFS Snapshot from the template, execute the following command:
[source,shell]
....
# zfs snapshot zroot/jails/templates/13.2-RELEASE@base
....
-Once the OpenZFS Snapshot has been created infinite jails can be created using the OpenZFS clone function.
+Once the OpenZFS Snapshot has been created, infinite jails can be created using the OpenZFS clone function.
-To create a Thin Jail named `thinjail` execute the following command:
+To create a Thin Jail named `thinjail`, execute the following command:
[source,shell]
....
# zfs clone zroot/jails/templates/13.2-RELEASE@base zroot/jails/containers/thinjail
....
-The last step is to configure it.
-It will be necessary to add an entry to the configuration file [.filename]#/etc/jail.conf# or in [.filename]#jail.conf.d# with the data of the jail.
+The last step is to configure the jail.
+It will be necessary to add an entry to the configuration file [.filename]#/etc/jail.conf# or in [.filename]#jail.conf.d# with the parameters of the jail.
An example would be the following:
@@ -478,7 +479,7 @@ thinjail {
}
....
-And then execute the following command to start the jail:
+Execute the following command to start the jail:
[source,shell]
....
@@ -488,10 +489,9 @@ And then execute the following command to start the jail:
More information on how to manage jails can be found in the section <<jail-management>>.
[[creating-thin-jail-nullfs]]
-=== Creating a Thin Jail using NullFS
+=== Creating a Thin Jail Using NullFS
-Combining Thin Jails and NullFS, a jail can be created with reduced duplication of system files by using Thin Jail techniques,
-and use NullFS to selectively share specific directories from the host system into the jail.
+A jail can be created with reduced duplication of system files by using the Thin Jail technique and using NullFS to selectively share specific directories from the host system into the jail.
The first step is to create the dataset to save the template, execute the following command if using OpenZFS:
@@ -514,14 +514,14 @@ Then execute the following command to download the userland:
# fetch https://download.freebsd.org/ftp/releases/amd64/amd64/13.2-RELEASE/base.txz -o /usr/local/jails/media/13.2-RELEASE-base.txz
....
-Once the download is complete it will be necessary to extract the contents in the template directory executing the following command:
+Once the download is complete, it will be necessary to extract the contents in the template directory by executing the following command:
[source,shell]
....
# tar -xf /usr/local/jails/media/13.2-RELEASE-base.txz -C /usr/local/jails/templates/13.2-RELEASE-base --unlink
....
-Once the userland is extracted n the templates directory, it will be necessary to copy the timezone and the DNS servers files to the template directory executing the following command:
+Once the userland is extracted in the templates directory, it will be necessary to copy the timezone and DNS server files to the template directory by executing the following command:
[source,shell]
....
@@ -529,7 +529,7 @@ Once the userland is extracted n the templates directory, it will be necessary t
# cp /etc/localtime /usr/local/jails/templates/13.2-RELEASE-base/etc/localtime
....
-With the files moved to the template, the next thing to do is update to the latest patch level executing the following command:
+With the files moved to the template, the next thing to do is update to the latest patch level by executing the following command:
[source,shell]
....
@@ -569,7 +569,7 @@ Execute the following commands to create the directories:
# mv /usr/local/jails/templates/13.2-RELEASE-base/root /usr/local/jails/templates/13.2-RELEASE-skeleton/root
....
-The next step will be to create the symlinks to the `skeleton` by executing the following commands:
+The next step is to create the symlinks to the `skeleton` by executing the following commands:
[source,shell]
....
@@ -585,7 +585,7 @@ The next step will be to create the symlinks to the `skeleton` by executing the
With the `skeleton` ready, it will be necessary to copy the data to the jail directory.
-In case of using OpenZFS, the OpenZFS snapshots will be a good ally to create as many jails as necessary by executing the following commands:
+In case of using OpenZFS, OpenZFS snapshots can be used to easily create as many jails as necessary by executing the following commands:
[source,shell]
....
@@ -593,7 +593,7 @@ In case of using OpenZFS, the OpenZFS snapshots will be a good ally to create as
# zfs clone zroot/jails/templates/13.2-RELEASE-skeleton@base zroot/jails/containers/thinjail
....
-In case of using UFS the man:cp[1] program can be used executing the following commands:
+In case of using UFS the man:cp[1] program can be used by executing the following commands:
[source,shell]
....
@@ -608,7 +608,7 @@ Then create the directory in which the base template and the skeleton will be mo
# mkdir -p /usr/local/jails/thinjail-nullfs-base
....
-Add the jail entry in [.filename]#/etc/jail.conf# as follows:
+Add a jail entry in [.filename]#/etc/jail.conf# or a file in [.filename]#jail.conf.d# as follows:
[.programlisting]
....
@@ -644,7 +644,7 @@ Then the create the [.filename]#/usr/local/jails/thinjail-nullfs-base.fstab# fil
/usr/local/jails/containers/thinjail /usr/local/jails/thinjail-nullfs-base/skeleton nullfs rw 0 0
....
-Then the jail can be started as usual:
+Execute the following command to start the jail:
[source,shell]
....
@@ -654,9 +654,9 @@ Then the jail can be started as usual:
[[creating-vnet-jail]]
=== Creating a VNET Jail
-FreeBSD VNET Jails have its own distinct networking stack, including interfaces, IP addresses, routing tables and firewall rules.
+FreeBSD VNET Jails have their own distinct networking stack, including interfaces, IP addresses, routing tables, and firewall rules.
-The first step will be to create the man:bridge[4] executing the following command:
+The first step to create a VNET jail is to create the man:bridge[4] by executing the following command:
[source,shell]
....
@@ -670,14 +670,14 @@ The output should be similar to the following:
bridge0
....
-With the `bridge` already created, it will be necessary to attach it to the `em0` interface by executing the following commands:
+With the `bridge` created, it will be necessary to attach it to the `em0` interface by executing the following command:
[source,shell]
....
# ifconfig bridge0 addm em0
....
-To make this setting persist across reboots add the following lines to [.filename]#/etc/rc.conf#:
+To make this setting persist across reboots, add the following lines to [.filename]#/etc/rc.conf#:
[.programlisting]
....
@@ -686,13 +686,14 @@ cloned_interfaces="bridge0"
ifconfig_bridge0="inet 192.168.1.150/24 addm em0 up"
....
-With the bridge already created, the next step will be to create the jail as indicated above.
+The next step is to create the jail as indicated above.
-Either the <<classic-jail>> procedure and the <<thin-jail>> procedure can be used, the only thing that will change will be the configuration of the [.filename]#/etc/jail.conf# file.
+Either the <<classic-jail>> procedure and the <<thin-jail>> procedure can be used.
+The only thing that will change is the configuration in the [.filename]#/etc/jail.conf# file.
The path [.filename]#/usr/local/jails/containers/vnet# will be used as an example for the created jail.
-This configuration for the VNET jail will be used as an example:
+The following is an example configuration for a VNET jail:
[.programlisting]
....
@@ -740,9 +741,10 @@ vnet {
[[creating-linux-jail]]
=== Creating a Linux Jail
-FreeBSD can run Linux inside a jail using the crossref:linuxemu[linuxemu,Linux Binary Compatibility] and man:debootstrap[8].
-Jails do not have a kernel, they run on the host's kernel.
-Therefore it is necessary to enable the Linux Binary Compatibility in the host system.
+FreeBSD can run Linux inside a jail using crossref:linuxemu[linuxemu,Linux Binary Compatibility] and man:debootstrap[8].
+Jails do not have a kernel.
+They run on the host's kernel.
+Therefore it is necessary to enable Linux Binary Compatibility in the host system.
To enable the Linux ABI at boot time, execute the following command:
@@ -759,9 +761,9 @@ Once enabled, it can be started without rebooting by executing the following com
....
The next step will be to create a jail as indicated above, for example in <<creating-thin-jail-openzfs-snapshots>>, but *without* performing the configuration.
-The FreeBSD Linux jails require a specific configuration that will be detailed below.
+FreeBSD Linux jails require a specific configuration that will be detailed below.
-Once the machine has been created as explained above, execute the following command to perform some configurations to the machine and start it:
+Once the jail has been created as explained above, execute the following command to perform required configuration for the jail and start it:
[source,shell]
....
@@ -785,7 +787,7 @@ Once the machine has been created as explained above, execute the following comm
enforce_statfs=1
....
-Then it will be necesary to access the jail to install package:sysutils/debootstrap[].
+To access the jail, it will be necessary to install package:sysutils/debootstrap[].
Execute the following command to access the FreeBSD Linux jail:
@@ -794,7 +796,7 @@ Execute the following command to access the FreeBSD Linux jail:
# jexec -u root ubuntu
....
-Inside the jail execute the following commands to install package:sysutils/debootstrap[] and prepare the Ubuntu environment:
+Inside the jail, execute the following commands to install package:sysutils/debootstrap[] and prepare the Ubuntu environment:
[source,shell]
....
@@ -852,7 +854,7 @@ Then the jail can be started as usual with the following command:
# service jail start ubuntu
....
-And access to the Ubuntu environment using the following command:
+The Ubuntu environment can be accessed using the following command:
[source,shell]
....
@@ -864,13 +866,13 @@ More information can be found in the chapter crossref:linuxemu[linuxemu,Linux Bi
[[jail-management]]
== Jail Management
-Once the jail is created, there are a number of operations that can be performed like starting, rebooting or deleting the jail, installing software in it, etc.
-In this section the different actions that can be done with the jails created in the host will be described.
+Once the jail is created, there are a number of operations that can be performed, like starting, rebooting or deleting the jail, installing software in it, etc.
+In this section the different actions that can be done with jails from the host will be described.
[[list-running-jails]]
=== List Running Jails
-To list the different jails that are running on the host system, the command man:jls[8] can be used:
+To list the jails that are running on the host system, the command man:jls[8] can be used:
[source,shell]
....
@@ -900,7 +902,7 @@ The output should be similar to the following:
....
[[start-jail]]
-=== Start, Restart and Stop a Jail
+=== Start, Restart, and Stop a Jail
man:service[8] is used to start, reboot, or stop a jail on the host.
@@ -916,48 +918,48 @@ Change the `start` argument to `restart` or `stop` to perform other actions on t
[[destroy-jail]]
=== Destroy a Jail
-Destroying a jail is not as simple as stopping the jail using man:service[8], removing the jail directory and the [.filename]#/etc/jail.conf# entry.
+Destroying a jail is not as simple as stopping the jail using man:service[8] and removing the jail directory and [.filename]#/etc/jail.conf# entry.
FreeBSD takes system security very seriously.
For this reason there are certain files that not even the root user can delete.
This functionality is known as File Flags.
-The first step will be to stop the desired jail executing the following command:
+The first step is to stop the desired jail executing the following command:
[source,shell]
....
# service jail stop jailname
....
-The second step will be to remove these flags with man:chflags[1] executing the following command, in which `classic` is the name of the jail to remove:
+The second step is to remove these flags with man:chflags[1] by executing the following command, in which `classic` is the name of the jail to remove:
[source,shell]
....
# chflags -R 0 /usr/local/jails/classic
....
-The third step will be to delete the directory where the jail was:
+The third step is to delete the directory where the jail was:
[source,shell]
....
# rm -rf /usr/local/jails/classic
....
-Finally, it will be necessary to remove the jail entry in the file [.filename]#/etc/jail.conf#.
+Finally, it will be necessary to remove the jail entry in [.filename]#/etc/jail.conf# or in [.filename]#jail.conf.d#.
[[handle-packages-jail]]
=== Handle Packages in a Jail
The man:pkg[8] tool supports the `-j` argument in order to handle packages installed inside the jail.
-For example, to install package:nginx-lite[] in the jail, the next command will be executed *from the host*:
+For example, to install package:nginx-lite[] in the jail, the next command can be executed *from the host*:
[source,shell]
....
# pkg -j classic install nginx-lite
....
-For more information on working with packages on FreeBSD see the chapter // TODO: Link to the chapter
+For more information on working with packages in FreeBSD, see crossref:ports[ports,"Installing Applications: Packages and Ports"].
[[access-jail]]
=== Access a Jail
@@ -974,7 +976,7 @@ The jail can be entered by running man:jexec[8] from the host:
When gaining access to the jail, the message configured in man:motd[5] will be displayed.
[[execute-commands-jail]]
-=== Execute commands in a Jail
+=== Execute Commands in a Jail
To execute a command from the host system in a jail the man:jexec[8] can be used.
@@ -995,9 +997,9 @@ Upgrading FreeBSD Jails ensures that the isolated environments remain secure, up
Jails *must be updated from the host* operating system.
The default behavior in FreeBSD is to disallow the use of man:chflags[1] in a jail.
-This will prevent the update of some fails so updating from withing the jail will fail.
+This will prevent the update of some files so updating from withing the jail will fail.
-To update the jail to the latest patch release of the version of FreeBSD it is already running, execute the following commands on the host:
+To update the jail to the latest patch release of the version of FreeBSD it is running, execute the following commands on the host:
[source,shell]
....
@@ -1026,8 +1028,8 @@ For example to upgrade from 13.1-RELEASE to 13.2-RELEASE, execute the following
[NOTE]
====
-It is necessary to execute two times the `install` step.
-The first one to upgrade the kernel and the second one to the rest of the components.
+It is necessary to execute the `install` step two times.
+The first one upgrades the kernel, and the second one upgrades the rest of the components.
====
Then, if it was a major version upgrade, reinstall all installed packages and restart the jail again.
@@ -1042,12 +1044,13 @@ From the host:
....
[[upgrading-thin-jail]]
-=== Upgrading a Thin Jail using NullFS
+=== Upgrading a Thin Jail Using NullFS
-Since Thin Jails that use NullFS share the majority of system directories, they are very easy to update, it is enough to update the template.
-This will allow to update multiple jails at the same time.
+Since Thin Jails that use NullFS share the majority of system directories, they are very easy to update.
+It is enough to update the template.
+This allows updating multiple jails at the same time.
-To update the template to the latest patch release of the version of FreeBSD it is already running, then execute the following commands on the host:
+To update the template to the latest patch release of the version of FreeBSD it is running, execute the following commands on the host:
[source,shell]
....
@@ -1058,7 +1061,7 @@ To update the template to the latest patch release of the version of FreeBSD it
To upgrade the template to a new major or minor version, first upgrade the host system as described in crossref:cutting-edge[freebsdupdate-upgrade,"Performing Major and Minor Version Upgrades"].
Once the host has been upgraded and rebooted, the template can then be upgraded.
-For example to upgrade from 13.1-RELEASE to 13.2-RELEASE, execute the following commands on the host:
+For example, to upgrade from 13.1-RELEASE to 13.2-RELEASE, execute the following commands on the host:
[source,shell]
....
@@ -1069,8 +1072,8 @@ For example to upgrade from 13.1-RELEASE to 13.2-RELEASE, execute the following
# service jail restart
....
-[[jail-resources-limits]]
-== Jail Resources Limits
+[[jail-resource-limits]]
+== Jail Resource Limits
Controlling the resources that a jail uses from the host system is a task to be taken into account by the system administrator.
@@ -1081,14 +1084,14 @@ man:rctl[8] allows you to manage the resources that a jail can use from the host
The `kern.racct.enable` tunable must be enabled at [.filename]#/boot/loader.conf#.
====
-The syntax to limit the resources of a jail would be:
+The syntax to limit the resources of a jail is as follows:
[.programlisting]
....
rctl -a jail:<jailname>:resource:action=amount/percentage
....
-For example, to limit the maximum RAM that a jail can access run the following command:
+For example, to limit the maximum RAM that a jail can access, run the following command:
[source,shell]
....
@@ -1104,11 +1107,10 @@ jail:classic:memoryuse:deny=2G/jail
More information on resource limits can be found in the security chapter in the crossref:security[security-resourcelimits,"Resource Limits section"].
-[[jail-managers-and-container]]
+[[jail-managers-and-containers]]
== Jail Managers and Containers
-As previously explained, the different FreeBSD Jails can be created and configured manually.
-But FreeBSD has some third-party utilities to make configuration and administration easier.
+As previously explained, each type of FreeBSD Jail can be created and configured manually, but FreeBSD also has third-party utilities to make configuration and administration easier.
Below is an incomplete list of the different FreeBSD Jail managers: