jails-topics.md
· 2.1 KiB · Markdown
Raw
Topics taken from our jails 2.0 spreadsheet for ranked choice voting:
```
5 have a userland jail daemon similar in concept to docker/podman daemon
7 teach jail(8) to export jail.conf params & vars as env vars into exec hooks
8 extend ucl support to more jail tools
9 allow user-managed rootless jails, similar to rootless podman on linux
11 kernel-managed state machines for jails, to allow operators to *know* what is blocking a jail from dying/restarting
12 teach ifconfig to auto-create epairs for vnet jails
13 associate mountpoints with jails, to allow better cleanup
14 allow dtrace within jails
15 document zfs & nested jails better
16 teach all userland tools to work with jail UUIDs
17 jail v2.0 tool (ucl config, libxo everywhere, getopt parsing, nvlist/netlink internally)
18 add a jail test suite
19 parallelisable startup/shutdown
20 bring back umapfs to allow jails to share read-only file systems
21 have a ucl-based schema for jail configs
22 allow combining network & firewall rules with jail configs (e.g. deploy a redis, with appropriate ports mapped)
23 make jails "exportable" and "importable" with pkg
24 document tarfs jail usage
25 make libucl allow substitutions or variables, jail.conf needs this functionality today
26 notify via devctl when (jailed) interfaces leave/arrive in base system
27 add JIDs to syslog and dmesg already
28 fake uid/gid in jailed filesystem
30 update jail(8) with links to all jail-aware tools, and add more examples
31 deprecate user-defined jids, except via sysctl, kernel to issue dmesg when jid rolls over
33 MAC ACL - lock user to prevent escalation to root uid
34 MAC ACL - lock IP & iface mac address, to reduce need for nested jails just for interface locking
35 teach tcpdump(8) to display jid along with traffic
36 teach jls(8) how to get all jail(8) data back, or most of it (kern.*, exec.*, jail sysctls should be visible in a single place)
38 display jail uptime as distinct from host uptime
40 make nsswitch jail-aware so you can ping <jailname> for example
41 simplify linking jails to real-world networks in a way that is resilient to interface state changes
```
Topics taken from our jails 2.0 spreadsheet for ranked choice voting:
5 have a userland jail daemon similar in concept to docker/podman daemon
7 teach jail(8) to export jail.conf params & vars as env vars into exec hooks
8 extend ucl support to more jail tools
9 allow user-managed rootless jails, similar to rootless podman on linux
11 kernel-managed state machines for jails, to allow operators to *know* what is blocking a jail from dying/restarting
12 teach ifconfig to auto-create epairs for vnet jails
13 associate mountpoints with jails, to allow better cleanup
14 allow dtrace within jails
15 document zfs & nested jails better
16 teach all userland tools to work with jail UUIDs
17 jail v2.0 tool (ucl config, libxo everywhere, getopt parsing, nvlist/netlink internally)
18 add a jail test suite
19 parallelisable startup/shutdown
20 bring back umapfs to allow jails to share read-only file systems
21 have a ucl-based schema for jail configs
22 allow combining network & firewall rules with jail configs (e.g. deploy a redis, with appropriate ports mapped)
23 make jails "exportable" and "importable" with pkg
24 document tarfs jail usage
25 make libucl allow substitutions or variables, jail.conf needs this functionality today
26 notify via devctl when (jailed) interfaces leave/arrive in base system
27 add JIDs to syslog and dmesg already
28 fake uid/gid in jailed filesystem
30 update jail(8) with links to all jail-aware tools, and add more examples
31 deprecate user-defined jids, except via sysctl, kernel to issue dmesg when jid rolls over
33 MAC ACL - lock user to prevent escalation to root uid
34 MAC ACL - lock IP & iface mac address, to reduce need for nested jails just for interface locking
35 teach tcpdump(8) to display jid along with traffic
36 teach jls(8) how to get all jail(8) data back, or most of it (kern.*, exec.*, jail sysctls should be visible in a single place)
38 display jail uptime as distinct from host uptime
40 make nsswitch jail-aware so you can ping <jailname> for example
41 simplify linking jails to real-world networks in a way that is resilient to interface state changes