jails /etc/jail.conf: configuring a parent and child jail

[usbdetach]

I'm looking for working examples of jail.conf for a parent jail where I can run 'service jail start' inside the parent jail to launch the child jail.

Creating a jail works but creating a parent jail where the child jail also works has been a challenge.

The host's /etc/jail.conf describing the parent jail:

parent {
   exec.start = "/bin/sh /etc/rc";
   exec.stop = "/bin/sh /etc/rc.shutdown";
   exec.consolelog = "/var/log/jail_console_${name}.log";
   allow.mount;
   allow.mount.devfs;
   allow.mount.procfs;
   allow.mlock;
   allow.raw_sockets;
   allow.mount.nullfs;
   enforce_statfs=1;
   exec.clean;
   mount.devfs;
   devfs_ruleset=11;
   host.hostname="${name}";
   path="/usr/local/jails/containers/${name}";
   ip4.addr=lo0|127.0.0.2/8;
   children.max=10;
}

The parent's /etc/jail.conf describing the child jail:

child {
   exec.start = "/bin/sh /etc/rc";
   exec.stop = "/bin/sh /etc/rc.shutdown";
   exec.consolelog = "/var/log/jail_console_${name}.log";
   allow.raw_sockets;
   exec.clean;
   devfs_ruleset=0;
   mount.devfs;
   host.hostname="${name}";
   path="/usr/local/jails/containers/${name}";
   ip4.addr=lo0|127.0.0.3/8;
   children.max=0;
}

At the moment, the error I see when running 'service jail start' inside the parent jail is this:

Starting jails:ifconfig: ioctl (SIOCAIFADDR): Operation not permitted
jail: child: /sbin/ifconfig lo0 inet 127.0.0.3/8 alias: failed

 

[usbdetach]

If I omit the ip4.addr= statement, the child jail starts. I seem to be missing something that allows the child to see the loopback interface.

 

[usbdetach]

Now playing with a vnet in the parent jail. The child jail can borrow the interface with it's own IP address.

parent jail.conf:

vnet;

child jail.conf:

ip4.addr=lo0|127.0.0.3/8;

run ifconfig from parent:

lo0: flags=1008049<UP,LOOPBACK,RUNNING,MULTICAST,LOWER_UP> metric 0 mtu 16384
        options=680003<RXCSUM,TXCSUM,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>
        inet 127.0.0.1 netmask 0xff000000
        inet 127.0.0.3 netmask 0xff000000
        inet6 ::1 prefixlen 128
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x6
        groups: lo
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>

run ifconfig from child:

lo0: flags=1008049<UP,LOOPBACK,RUNNING,MULTICAST,LOWER_UP> metric 0 mtu 16384
        options=680003<RXCSUM,TXCSUM,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>
        inet 127.0.0.3 netmask 0xff000000
        groups: lo

Side note: with jail "child" defined inside jail "parent", from the host I can jump directly into the child using 'jexec parent.child' instead of 'jexec parent' followed by 'jexec child'. Did not know that trick until today.

At the moment parent and child can talk to each other and no one else. I'll need to create some gimmick to get the parent's lo0 to talk to the host but this is closer to what I want.

 

[usbdetach]

Looks like this so far:

$ jls
   JID  IP Address      Hostname                      Path
     1                  parent                         /usr/local/jails/containers/parent
     2  127.0.0.3       child                          /usr/local/jails/containers/parent/usr/local/jails/containers/child