Re: automatic creation of a chroot environment

---> This isn't better than Jails, it's a bit different.

I would call it a light jail. Do you like it ?

On Thu, Jul 16, 2026 at 2:46 PM Rozhuk Ivan <rozhuk.im@gmail.com> wrote:

> On Thu, 16 Jul 2026 09:09:01 +0200
> vermaden <vermaden@interia.pl> wrote:
>
> > > I've been using chroot for a long time to reduce
> > > the risk of web application hacking on my server.
> > >
> > > https://github.com/rozhuk-im/chroot_env
> >
> > Thank You for sharing, I will add this to next VN.
> >
> > Two questions out of curiosity ...
> >
> > 1. How is that better then 'Service Jails'?
> >
> > 2. How is that better then 'Single Process Jails'?
> >
> >
> https://vermaden.wordpress.com/2023/06/28/freebsd-jails-containers/#single-process-jails
> >
>
> This isn't better than Jails, it's a bit different.
>
> As a solution, the script doesn't rely on jails or zfs, but instead uses
> tmpfs and chroot. There's no network stack or OS kernel isolation.
> This solution can be used to run a browser on a workstation, so even if
> someone were able to download and run the code automatically, it likely
> wouldn't launch (due to noexec and nosuid). And if it did launch, there's
> nothing valuable in the isolated environment.
>
> The general idea is that if an application is hacked, there's no way to
> write files, and nothing can be run where files can be written. Even if
> it's possible to run something from the existing environment, almost
> nothing is available. Only the application's own data for reading and
> writing, and temporary files, are accessible.
> At the same time, the overhead of maintaining the solution is minimal: in
> my setup, it's enough to update ports and restart services; the script will
> automatically recreate the chroot with all the files needed for launching.
>
> Currently, everything is stored in tmpfs, but this can easily be changed
> to geom md + UFS2 image.
> In chroot, almost everything is mounted in RO, unlike in jails, where
> everything looks like a regular installation.
>
> You can adapt this script for your own purposes to create an environment
> with all dependencies.
> In your blog, you used /rescue/sh. The examples include examples/sh - the
> script will automatically copy everything needed to /bin/sh.
>
>
>
> PS: I wanted to rework portmaster/ports make so that it would build
> packages like poudriere in a clean environment, but without requiring zfs
> and complex management.
>
>

-- 
Mario.