ezjail Handbook section

[Warren Block]

On Wed, 20 Aug 2014, John Baldwin wrote:

> On Tuesday, August 19, 2014 6:01:54 pm Warren Block wrote:
>> On Mon, 4 Aug 2014, Warren Block wrote:
>>
>>> Draft version of an ezjail section for the Handbook Jails chapter:
>>> http://www.wonkity.com/~wblock/jails/jails-ezjail.html
>>>
>>> This includes a complete setup at the end for running BIND in a jail.
>>> In addition to a complete jail example, it can also serve as an example of
>>> how to set up BIND now that the old chroot configuration is no more.
>>
>> Asking for review again of the final version at the link above.  If
>> there are no major complaints in the next few days, it will be
>> committed.
>
> It's not clear to me if you need lo1?  If you are using aliases on an external
> interface as you would with a traditional jail then I think you don't need the
> lo1 interface?

It's there to keep jails from being involved with lo0 on the host.  But 
I admit the explanation is fuzzy, and will seek clarification.

(There is a bug that affects this also.  When the host is a gateway, the 
jails use a non-default loopback and raw sockets for ping, jails get the 
host address wrong.  More details in 
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=168678)

> Finally, if you haven't tried etcupdate, you should try it and see how it
> works compared to mergemaster.

I remember looking at it years back, but did not stick with it because 
it was a port and not installed by default.  Now that it's in base, it 
could be used in the update section as an alternative.  Although maybe 
it should be mentioned in the updating chapter rather than in the jails 
chapter.

Thanks!