Re: automatic creation of a chroot environment

>It was covered already two times :]

yes,thanks. But I meant on your website,not on the FreeBSD forums.

>hope someone finds this useful.
>https://github.com/rozhuk-im/chroot_env

Hi all,

chroot_env (https://github.com/rozhuk-im/chroot_env) is a lightweight
tmpfs+chroot sandbox for FreeBSD - no jails, no ZFS, RO by default,
noexec/nosuid on anything writable. As the author notes, one thing it
doesn't touch is the network stack: chroot(2) gives a sandboxed process the
same network access as its user has on the host.

I've added an opt-in network ACL that closes this gap without pulling in
jails or VNET:

- CHROOT_APP_PF_RULES: pf.conf-syntax rules loaded into a per-app anchor
(pfctl -a chroot_env/${CHROOT_USER} -f -). The script appends a deny-all
scoped to CHROOT_USER after your rules, so anything not explicitly passed
is blocked. The only one-time setup is a single "anchor \"chroot_env/*\""
line in the host pf.conf.
- CHROOT_PF_ANCHOR: anchor name override, same auto-default pattern already
used for CHROOT_GROUP.

It hooks into chroot_init/chroot_deinit the same way devfs rules and nullfs
maps already do, not through CHROOT_INIT_HOOK (which already owns the
default RO remount). setfib-based routing restriction and real VNET-style
isolation are out of scope by design - the script never executes the target
app, so those belong at the invocation site, not inside chroot_env.sh.
Documented, not automated.

Patch and a worked example attached (sandboxing a browser: port + PF rules
+ RW-mapped profile dir only, everything else RO/ephemeral). Syntax-checked
so far, not yet exercised against a live pf(4)/mount_nullfs/devfs setup -
testing and feedback welcome before calling it done.

Thanks,

On Thu, Jul 16, 2026 at 5:19 PM vermaden <vermaden@interia.pl> wrote:

>
> > // Rozhuk Ivan
> > https://github.com/mpv-player/mpv/pull/18221
> > Hope it will be merged sometimes :)
>
> Nice addition, I hope so, gonna add it to VN too :)
>
>
>
> > // Mario Marietto
> > > .. and I believe this is what You are looking for:
> > > - https://forums.freebsd.org/threads/bhyve-qemu-vmm.102735/
> >
> > yes, but this wasn't included between the VN?
> > I thought that that project was enough valuable
> > / trying to understand the criteria that makes a project valuable for
> you /
>
> It was covered already two times :]
>
> | % vernews 102735
> |
> | Qemu Accelerated with <tt>bhyve_vmm</tt> for First Time on FreeBSD.
> | https://forums.freebsd.org/threads/qemu-bhyve-vmm.102735/
> |
> | QEMU Bhyve Enabled Performance Comparison.
> | https://forums.freebsd.org/threads/qemu-bhyve.102735/page-2#post-763082
> |
> | % which vernews
> | vernews: aliased to find ~/misc/verblog/NEWS -name post.txt -print0 |
> xargs -0 -n1 grep -i -B 2 -A 1
>
> ... and this QEMU/Bhyve/VMM project is VERY valuable for me because of
> these reasons:
> -
> https://forums.freebsd.org/threads/qemu-bhyve-vmm.102735/page-2#post-761421
> -
> https://forums.freebsd.org/threads/qemu-bhyve-vmm.102735/page-2#post-761458
>
>
>
> Hope that helps.
>
> Regards,
> vermaden
>


-- 
Mario.