dch revised this gist 1 year ago. Go to revision
No changes
dch revised this gist 1 year ago. Go to revision
1 file changed, 35 insertions
jails-topics.md(file created)
| @@ -0,0 +1,35 @@ | |||
| 1 | + | Topics taken from our jails 2.0 spreadsheet for ranked choice voting: | |
| 2 | + | ||
| 3 | + | ``` | |
| 4 | + | 5 have a userland jail daemon similar in concept to docker/podman daemon | |
| 5 | + | 7 teach jail(8) to export jail.conf params & vars as env vars into exec hooks | |
| 6 | + | 8 extend ucl support to more jail tools | |
| 7 | + | 9 allow user-managed rootless jails, similar to rootless podman on linux | |
| 8 | + | 11 kernel-managed state machines for jails, to allow operators to *know* what is blocking a jail from dying/restarting | |
| 9 | + | 12 teach ifconfig to auto-create epairs for vnet jails | |
| 10 | + | 13 associate mountpoints with jails, to allow better cleanup | |
| 11 | + | 14 allow dtrace within jails | |
| 12 | + | 15 document zfs & nested jails better | |
| 13 | + | 16 teach all userland tools to work with jail UUIDs | |
| 14 | + | 17 jail v2.0 tool (ucl config, libxo everywhere, getopt parsing, nvlist/netlink internally) | |
| 15 | + | 18 add a jail test suite | |
| 16 | + | 19 parallelisable startup/shutdown | |
| 17 | + | 20 bring back umapfs to allow jails to share read-only file systems | |
| 18 | + | 21 have a ucl-based schema for jail configs | |
| 19 | + | 22 allow combining network & firewall rules with jail configs (e.g. deploy a redis, with appropriate ports mapped) | |
| 20 | + | 23 make jails "exportable" and "importable" with pkg | |
| 21 | + | 24 document tarfs jail usage | |
| 22 | + | 25 make libucl allow substitutions or variables, jail.conf needs this functionality today | |
| 23 | + | 26 notify via devctl when (jailed) interfaces leave/arrive in base system | |
| 24 | + | 27 add JIDs to syslog and dmesg already | |
| 25 | + | 28 fake uid/gid in jailed filesystem | |
| 26 | + | 30 update jail(8) with links to all jail-aware tools, and add more examples | |
| 27 | + | 31 deprecate user-defined jids, except via sysctl, kernel to issue dmesg when jid rolls over | |
| 28 | + | 33 MAC ACL - lock user to prevent escalation to root uid | |
| 29 | + | 34 MAC ACL - lock IP & iface mac address, to reduce need for nested jails just for interface locking | |
| 30 | + | 35 teach tcpdump(8) to display jid along with traffic | |
| 31 | + | 36 teach jls(8) how to get all jail(8) data back, or most of it (kern.*, exec.*, jail sysctls should be visible in a single place) | |
| 32 | + | 38 display jail uptime as distinct from host uptime | |
| 33 | + | 40 make nsswitch jail-aware so you can ping <jailname> for example | |
| 34 | + | 41 simplify linking jails to real-world networks in a way that is resilient to interface state changes | |
| 35 | + | ``` | |
Newer
Older