Solved Ubuntu 24.10 Oracular Oriole empty bin directory in jail

This is what I did according with your instructions :

Code:
# tar xvfp ubuntu-base-24.04-base-amd64.tar.gz -C /mnt/da4p2/Backup/compat/noble
# nano /etc/jail.conf.d/noble.conf

noble {
    # hostname/path
    host.hostname = "${name}";
    path = "/mnt/da4p2/Backup/compat/${name}";

    # permissions
    allow.raw_sockets;
    exec.clean;
    persist;
    sysvmsg=inherit;
    sysvsem=inherit;
    sysvshm=inherit;
    enforce_statfs=1;

    # permissions
    devfs_ruleset=7;

    # network
    ip4.addr="lo1|10.10.0.5/24";

    # mount
    mount += "devfs           $path/dev      devfs           rw                      0       0";
    mount += "tmpfs           $path/dev/shm  tmpfs           rw,size=1g,mode=1777    0       0";
    mount += "fdescfs         $path/dev/fd   fdescfs         rw,linrdlnk             0       0";
    mount += "linprocfs       $path/proc     linprocfs       rw                      0       0";
    mount += "linsysfs        $path/sys      linsysfs        rw                      0       0";
    mount += "/tmp            $path/tmp      nullfs          rw                      0       0";
    mount += "/home           $path/home     nullfs          rw                      0       0";
    mount += "/root           $path/root     nullfs          rw                      0       0";
    # mount the video directory from the host to the jail after creating it
    # mount += "/home/djwilcox/video $path/home/djwilcox/video  nullfs rw      0       0";
    # uncomment the line below for the xdg runtime directory for wayland after creating it
    mount += "/var/run/user/0 $path/run/user/0  nullfs rw            0       0";
}

# nano /etc/fstab :

proc                    /proc                                                                   procfs          rw         0    0

#nano /etc/rc.conf

# noble="YES"
jail_enable="YES"
jail_parallel_start="YES"

[root@marietto /mnt/da4p2/Backup/compat]==> service jail onestart noble
Starting jails: noble.

[root@marietto /mnt/da4p2/Backup/compat]==> jexec noble /bin/bash
ELF binary type "0" not known.
ELF binary type "0" not known.
jexec: execvp: /bin/bash: Exec format error

where is the mistake,please ? very thanks.
 
you need to do some set up for jails

the following steps are on freebsd

Code:
sudo pkg install doas

Edit the doas.conf file and change username to your username on freebsd

Code:
/usr/local/etc/doas.conf

Code:
# permit user
permit keepenv :username

# jail
permit nopass :username cmd jexec

# root as root
permit nopass keepenv root as root

freebsd devfs.rules

Code:
/etc/devfs.rules

Code:
[jail=7]
add include $devfsrules_jail
add path 'mixer*' unhide
add path 'dsp*' unhide
add path 'dri*' unhide
add path 'drm*' unhide
add path 'nvidia*' unhide
add path 'speaker*' unhide

after adding the devfs rules reboot

enable jails

Code:
sudo sysrc jail_enable="YES"
sudo sysrc cloned_interfaces="lo1"
sudo sysrc ifconfig_lo1_aliases="inet 10.10.0.1-12/24"

or edit the rc.conf by hand

Code:
/etc/rc.conf

Code:
jail_enable="YES"
cloned_interfaces="lo1"
ifconfig_lo1_aliases="inet 10.10.0.1-12/24"

Setting Up the Jail Directory Tree

this is how do it you can set your own locations

zroot/jails
create the zroot/jails zfs dataset and set the mountpoint

Code:
sudo zfs create zroot/jails
sudo zfs set mountpoint=/usr/local/jails zroot/jails

zroot/jails/linux
create the zroot/jails/linux zfs dataset and set the mountpoint

Code:
sudo zfs create zroot/jails/linux
sudo zfs set mountpoint=/usr/local/jails/linux zroot/jails/linux

zroot/jails/linux/ubuntu
create the zroot/jails/linux/ubuntu zfs dataset and set the mountpoint

Code:
sudo zfs create zroot/jails/linux/ubuntu
sudo zfs set mountpoint=/usr/local/jails/linux/ubuntu zroot/jails/linux/ubuntu

/etc/jail.conf
create the /etc/jail.conf file if it doesn’t exist

Code:
/etc/jail.conf

add the following code to the jail.conf file to include
files with a .conf extension in the etc/jail.conf.d directory

Code:
# startup/logging
exec.start = "/bin/sh /etc/rc";
exec.stop = "/bin/sh /etc/rc.shutdown";
exec.consolelog = "/var/log/jail_console_${name}.log";

create the etc/jail.conf.d directory

Code:
sudo mkdir -p /etc/jail.conf.d/

Code:
/etc/jail.conf.d/ubuntu.conf

Code:
ubuntu {
    # hostname/path
    host.hostname = "${name}";
    path = "/usr/local/jails/linux/${name}";

    # permissions
    allow.raw_sockets;
    exec.clean;
    persist;
    sysvmsg=inherit;
    sysvsem=inherit;
    sysvshm=inherit;
    enforce_statfs=1;

    # permissions
    devfs_ruleset=7;

    # network
    ip4.addr="lo1|10.10.0.5/24";

    # mount
    mount += "devfs           $path/dev      devfs           rw                      0       0";
    mount += "tmpfs           $path/dev/shm  tmpfs           rw,size=1g,mode=1777    0       0";
    mount += "fdescfs         $path/dev/fd   fdescfs         rw,linrdlnk             0       0";
    mount += "linprocfs       $path/proc     linprocfs       rw                      0       0";
    mount += "linsysfs        $path/sys      linsysfs        rw                      0       0";
    mount += "/tmp            $path/tmp      nullfs          rw                      0       0";
    mount += "/home           $path/home     nullfs          rw                      0       0";
    # mount the video directory from the host to the jail after creating it
    #mount += "/home/username/video $path/home/username/video  nullfs rw      0       0";
    # uncomment the line below for the xdg runtime directory for wayland after creating it
    #mount += "/var/run/xdg/username $path/run/user/1001  nullfs rw            0       0";
}

pf.conf

Code:
/etc/pf.conf

nat the jail

you need to add the following to your pf.conf
and it has to be added to the right section

Code:
nat on $int_if from {lo1:network} to any -> ($int_if)
antispoof log quick for { lo $int_if } label "block_spoofing"

my pf.conf

Code:
#=========================================================================#
# variables, macro and tables                                             #
#=========================================================================#

int_if="ue0" # usb to ethernet adaptor
#int_if="bge0" # thunderbolt to ethernet adaptor
#int_if="wlan0" # ralink usb wifi
vpn_if="tun0" # vpn interface
all_networks="0.0.0.0/0"
vpn_network="$vpn_if:network"
# 6881, 6882 = transmission. 22000, 21025 = syncthing
tcp_services = "{ ntp, 6881, 22000 }" # tcp services - torrent
udp_services = "{ ntp, 6882, 21025 }" # udp services - torrent
icmp_types = "{ echoreq, unreach }"
tcp_state="flags S/SA keep state"
udp_state="keep state"

#table <internet> { $all_networks, !self, !$int_if:network } # internet
#table <lan> { $int_if:network, !self }                      # lan network
table <myself> { self }                                     # self
table <martians> { 0.0.0.0/8 10.0.0.0/8 127.0.0.0/8 169.254.0.0/16     \
            172.16.0.0/12 192.0.0.0/24 192.0.2.0/24 224.0.0.0/3 \
            192.168.0.0/16 198.18.0.0/15 198.51.100.0/24        \
            203.0.113.0/24 }                         # broken networks

#=========================================================================#
# global policy                                                           #
#=========================================================================#

set block-policy drop
set loginterface $int_if
set fingerprints "/etc/pf.os"
set skip on lo0
scrub in all fragment reassemble no-df max-mss 1440
# nat jail
nat on $int_if from {lo1:network} to any -> ($int_if)
antispoof log quick for { lo $int_if } label "block_spoofing"

#=========================================================================#
# block                                                                   #
#=========================================================================#

block log all # block log all
block return out quick inet6 all tag IPV6 # block ipv6
block in quick inet6 all tag IPV6 # block ipv6

# block broken networks - turned off for synergy
# block in quick from { <martians> no-route urpf-failed } to any tag BAD_PACKET

#=========================================================================#
# anchors                                                                 #
#=========================================================================#

# emerging threats - anchor
#anchor "emerging-threats"
#load anchor "emerging-threats" from "/etc/pf.anchors/emerging-threats"

# openvpn - anchor
anchor "openvpn"

#=========================================================================#
# traffic tag                                                             #
#=========================================================================#

# icmp
pass inet proto icmp all icmp-type $icmp_types keep state tag ICMP

# Allow the tcp and udp services defined in the macros at the top of the file
pass in on $int_if inet proto tcp from any to ($int_if) port $tcp_services $tcp_state tag TCP_IN
pass in on $int_if inet proto udp from any to ($int_if) port $udp_services $udp_state tag UDP_IN

# outbound traffic
block out on $int_if all
pass out quick on $int_if all modulate state
#pass out quick on $int_if from <myself> to <lan> modulate state tag LAN_OUT
#pass out quick on $int_if from <myself> to <internet> modulate state tag INTERNET_OUT

Start linux

Use sysrc to set linux_enable=”YES” in your /etc/rc.conf

Code:
sudo sysrc linux_enable="YES"

make sure to start linux

Code:
sudo service linux onestart

edit your fstab and add proc

Code:
/etc/fstab

Code:
proc            /proc                   procfs          rw      0       0

download ubuntu base

Code:
fetch 'https://cdimage.ubuntu.com/ubuntu-base/releases/24.10/release/ubuntu-base-24.10-base-amd64.tar.gz'

then follow along from here


take it one step at a time
 
It seems that the steps that you have explained later should performed before the steps that I did. The problem is that your tutorial put them later,but they should be placed before the point where I started and I started at the very top of your tutorial. You should change the order of the commands that you wrote on the tutorial. Anyway I've been able to enter the jail and the Linuxulator / Noble :

[root@marietto /compat]==> jexec noble /bin/bash
groups: cannot find name for group ID 47
root@noble:/#
 
new ride, new mistake :

Code:
root@noble:/# uname -a
Linux noble 5.15.0 FreeBSD 14.1-RELEASE-p4 GENERIC x86_64 x86_64 x86_64 GNU/Linux                                                               
root@noble:/# echo nameserver 8.8.8.8 > /etc/resolv.conf
root@noble:/# printf "APT::Cache-Start 251658240;" > /etc/apt/apt.conf.d/00aptitude                                                                                 root@noble:/# printf "%b\n" "0.0 0 0.0\n0\nUTC" > /etc/adjtime
root@noble:/# apt update                                                                                                              
Error: List directory /var/lib/apt/lists/partial is missing. - Acquire (2: No such file or directory)
root@noble:/# cd /var                                                                                                                 
bash: cd: /var: No such file or directory
root@noble:/# ls                                                                                                                      
bin  boot  dev  etc  home  lib  lib64  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr
root@noble:/# cd var                                                                                                                  
bash: cd: var: No such file or directory
 
you need to copy your user and group settings from freebsd to the jail
so you have the same uid and guid in the jail as on the host

follow the steps in this guide


these are the steps
but run the commands in the link above

because we install pulse audio later using the guide above

 
odd you dont have a /var directory

making mistakes and then fixing them is just part of the learning process

how did you extract the ubuntu base file
 
i have created 2 scripts called wrapper-freebsd and wrapper-jail

which are used with desktop entries on freebsd
to launch gui applications in a linux or freebsd jail from your application launcher

wrapper-freebsd
is installed on freebsd

wrapper-jail
is installed in the jail

then you create desktop entries that call the wrapper-freebsd script
and you pass in in the option to the script in the Exec line of the desktop entry

name of the jail with -j
the application name with -a
and -p on to enable audio

the wrapper-freebsd script passes in the DBUS_SESSION_BUS_ADDRESS
from the host to the jail

starting davinci resolve in a ubuntu 24.10 jail
with pulseaudio enabled

Code:
Name=DaVinci Resolve
Exec=/home/djwilcox/bin/wrapper-freebsd -j 'ubuntu' -a 'resolve' -p 'on'

starting google earth pro desktop

Code:
Name=Google Earth
Exec=/home/djwilcox/bin/wrapper-freebsd -j 'ubuntu' -a 'google-earth-pro'

Freebsd

desktop entries

Code:
~/.local/share/applications

davinci-resolve.desktop

Code:
[Desktop Entry]
Version=1.0
Encoding=UTF-8
Type=Application
Name=DaVinci Resolve
Exec=/home/djwilcox/bin/wrapper-freebsd -j 'ubuntu' -a 'resolve' -p 'on'
Icon=/usr/local/jails/linux/ubuntu/opt/resolve/graphics/DV_Resolve.png
Terminal=false
MimeType=application/x-resolveproj;
StartupNotify=true
Categories=AudioVideo

google-earth.desktop

Code:
[Desktop Entry]
Version=1.0
Encoding=UTF-8
Type=Application
Name=Google Earth
Exec=/home/djwilcox/bin/wrapper-freebsd -j 'ubuntu' -a 'google-earth-pro'
Terminal=false
MimeType=application/x-resolveproj;
StartupNotify=true
Categories=AudioVideo

pulseaudio set up

Code:
~/.config/pulse/default.pa

Code:
#!/usr/local/bin/pulseaudio -nF

# include default.pa and override
.include /usr/local/etc/pulse/default.pa

# jail
.ifexists module-esound-protocol-unix.so
load-module module-esound-protocol-unix
.endif
load-module module-native-protocol-unix socket=/tmp/pulseaudio.socket

# default sink
#set-default-sink oss_output.dsp1
#set-default-source oss_input.dsp0

wrapper-freebsd script

Code:
~/bin/wrapper-freebsd

Code:
#!/bin/sh

# wrapper-freebsd

#===============================================================================
# script usage
#===============================================================================

usage () {
# if argument passed to function echo it
[ -z "${1}" ] || echo "! ${1}"
# display help
echo "\
# script usage
$(basename "$0") -j jail -a application -p on
-p on = enable audio on the freebsd host for the jail
"
exit 2
}

#===============================================================================
# check the number of arguments passed to the script
#===============================================================================

[ $# -gt 0 ] || usage "${WRONG_ARGS_ERR}"


#===============================================================================
# getopts check the options passed to the script
#===============================================================================

while getopts ':j:a:p:h' opt
do
  case ${opt} in
     j) jail="${OPTARG}";;
     a) app="${OPTARG}";;
     p) audio="${OPTARG}";;
     h) usage;;
     \?) usage "${INVALID_OPT_ERR} ${OPTARG}" 1>&2;;
     :) usage "${INVALID_OPT_ERR} ${OPTARG} ${REQ_ARG_ERR}" 1>&2;;
  esac
done
shift $((OPTIND-1))

#===============================================================================
# start audio if -p on option is specified
#===============================================================================

# default audio off
audio_default="off"

# start audio
audio () {
pulseaudio --start --daemonize 2>/dev/null
}

# check if pulseaudio should be started
case "${audio:=${audio_default}}" in
    on) audio;;
    off) echo 'off';;
    *) usage;;
esac


#===============================================================================
# doas jexec into the jail and run the wrapper script to start the application
#===============================================================================

doas jexec "${jail}" \
/usr/local/bin/wrapper-jail \
-u "${USER}" \
-d "DBUS_SESSION_BUS_ADDRESS=${DBUS_SESSION_BUS_ADDRESS}" \
-a "${app}" \
"$@"

Jail

pulseaudio

Code:
~/.config/pulse/client.conf

Code:
# This file is part of PulseAudio.
#
# PulseAudio is free software; you can redistribute it and/or modify
# it under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# PulseAudio is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public License
# along with PulseAudio; if not, see <http://www.gnu.org/licenses/>.

## Configuration file for PulseAudio clients. See pulse-client.conf(5) for
## more information. Default values are commented out.  Use either ; or # for
## commenting.

; default-sink = oss_output.dsp1
; default-source =
default-server = /tmp/pulseaudio.socket
; default-dbus-server =

; autospawn = yes
; daemon-binary = /usr/local/bin/pulseaudio
; extra-arguments = --log-target=syslog

; cookie-file =

; enable-shm = yes
; shm-size-bytes = 0 # setting this 0 will use the system-default, usually 64 MiB

; auto-connect-localhost = no
; auto-connect-display = no

zshenv

dummy-uvm.so for the gpu

Code:
# ~/.zshenv

# for ZSH
case "$OSTYPE" in
  freebsd*)
  # Path
  typeset -U PATH path
  path=("$path[@]")
  export PATH

  # XDG_RUNTIME_DIR
  export XDG_RUNTIME_DIR=/var/run/xdg/"${USER}"

  # wayland - uncomment to use wayland
  export WAYLAND_DISPLAY=wayland-0
  export QT_QPA_PLATFORM=wayland
  export GDK_BACKEND=wayland
  ;;
  linux*)
  typeset -U PATH path
  path=("/opt/resolve/bin" "/bin" "/usr/bin" "$path[@]")
  export PATH

  # XDG_RUNTIME_DIR
  export XDG_RUNTIME_DIR="/run/user/`id -u`"

  # dummy-uvm.so for access to the gpu
  export LD_PRELOAD="${HOME}"/.config/gpu/dummy-uvm.so
  export __NV_PRIME_RENDER_OFFLOAD=1
  export __GLX_VENDOR_LIBRARY_NAME=nvidia

  # wayland - uncomment to use wayland
  #export WAYLAND_DISPLAY=wayland-0
  #export QT_QPA_PLATFORM=wayland
  #export GDK_BACKEND=wayland

  # x11 - comment out to use wayland
  #export DISPLAY=unix:0
  export DISPLAY=:0
  export QT_QPA_PLATFORM=xcb
  export GDK_BACKEND=x11
  ;;
esac

# xdg directories
export XDG_CONFIG_HOME="$HOME/.config"
export XDG_CACHE_HOME="$HOME/.cache"
export XDG_DATA_HOME="$HOME/.local/share"

# qt5
export QT_QPA_PLATFORMTHEME=qt5ct

wrapper-jail script

Code:
/usr/local/bin/wrapper-jail

Code:
#!/bin/sh

#===============================================================================
# wrapper-jail
#===============================================================================

#===============================================================================
# script usage
#===============================================================================

usage () {
# if argument passed to function echo it
[ -z "${1}" ] || echo "! ${1}"
# display help
echo "\
# script usage
$(basename "$0") -u ${USER}"
exit 2
}

#===============================================================================
# check the number of arguments passed to the script
#===============================================================================

[ $# -gt 0 ] || usage "${WRONG_ARGS_ERR}"


#===============================================================================
# getopts check the options passed to the script
#===============================================================================

while getopts ':u:d:a:h' opt
do
  case ${opt} in
     u) username="${OPTARG}";;
     d) dbus="${OPTARG}";;
     a) app="${OPTARG}";;
     h) usage;;
     \?) usage "${INVALID_OPT_ERR} ${OPTARG}" 1>&2;;
     :) usage "${INVALID_OPT_ERR} ${OPTARG} ${REQ_ARG_ERR}" 1>&2;;
  esac
done
shift $((OPTIND-1))


#===============================================================================
# switch to our user in the jail and start the application
#===============================================================================

su "${username}" -c "${dbus} ${app} ${@}" 2>/dev/null

dotfiles


bin directory

 
google chrome playing drm content on itv

install ublock origin lite in google chrome


i was having issues with channel4.com main page rendering
it was just blank

after install ublock origin lite the page render perfectly, go figure

obviously you have to download the deb for google chrome and install it in the jail

Code:
~/.local/share/applications/google-chome.desktop

google-chome.desktop

Code:
[Desktop Entry]
Version=1.0
Encoding=UTF-8
Type=Application
Name=Google Chrome
Exec=/home/djwilcox/bin/wrapper-freebsd -j 'ubuntu' -p 'on' -a 'google-chrome --no-sandbox --no-zygote --ozone-platform=wayland --ignore-gpu-blocklist --disable-gpu-driver-bug-workarounds --enable-gpu-rasterization --enable-unsafe-webgpu --enable-zero-copy --enable-drdc --skia-graphite --enable-webgl-draft-extensions --enable-features=Vulkan,UseSkiaRendererer --use-vulkan --enable-features=VaapiVideoDecoder,VaapiVideoEncoder --canvas-oop-rasterization --enable-webgpu-developer-features --origin-trial-enabled-features=WebGPU --test-type --v=0 "$@"'
Terminal=false
MimeType=application/x-resolveproj;
StartupNotify=true
Categories=AudioVideo

wrapper-freebsd command

Code:
wrapper-freebsd -j 'ubuntu' -p 'on' -a 'google-chrome --no-sandbox --no-zygote --ozone-platform=wayland --ignore-gpu-blocklist --disable-gpu-driver-bug-workarounds --enable-gpu-rasterization --enable-unsafe-webgpu --enable-zero-copy --enable-drdc --skia-graphite --enable-webgl-draft-extensions --enable-features=Vulkan,UseSkiaRendererer --use-vulkan --enable-features=VaapiVideoDecoder,VaapiVideoEncoder --canvas-oop-rasterization --enable-webgpu-developer-features --origin-trial-enabled-features=WebGPU --test-type --v=0 "$@"'

chrome://gpu

20241102_15h41m47s_grim.png


20241102_15h42m07s_grim.png
 
im installing linux in a jail and not in /compat
im not using the linuxulator so couldnt say
you dont need to add linprocfs and linsysfs to your fstab

it does not care. If you don't add linprocfs and linsysfs on fstab,you will use them inside the jail configuration file,so you are using the linuxulator.
 
one issue is if you close google chrome
you need to restart the jail before you can open it again

dont know why

This is how Chrome works every time even if i-notify hasn't been implemented :

Code:
# doas service jail stop noble
# doas service jail start noble
# doas jexec noble bash start-chrome

nano /mnt/da4p2/Backup/compat/noble/usr/bin/start-chrome :

Code:
#!/mnt/da4p2/Backup/compat/noble/bin/bash
#
# chrome wrapper script from patovm04:
# https://forums.freebsd.org/threads/linuxulator-how-to-run-google-chrome-linux-binary-on-freebsd.77559/
#
export CHROME_PATH="/opt/google/chrome/chrome"
export CHROME_WRAPPER="$(readlink -f "$0")"
export LD_LIBRARY_PATH=/usr/local/steam-utils/lib64/fakeudev
export LD_PRELOAD=/usr/local/steam-utils/lib64/webfix/webfix.so
export LIBGL_DRI3_DISABLE=1
exec -a "$0" "$CHROME_PATH" \
    --password-store=basic  \
    --use-gl=desktop \
    --use-cmd-decoder=validating \
    --disable-software-rasterizer \
    --disable-font-subpixel-positioning \
    --disable-gpu-driver-bug-workarounds \
    --disable-gpu-driver-workarounds \
    --disable-gpu-vsync \
    --enable-accelerated-video-decode \
    --enable-accelerated-mjpeg-decode \
    --enable-features=VaapiVideoDecoder,VaapiVideoEncoder,CanvasOopRasterization \
    --enable-gpu-compositing \
    --enable-gpu-rasterization \
    --enable-native-gpu-memory-buffers \
    --enable-oop-rasterization \
    --canvas-oop-rasterization \
    --enable-raw-draw \
    --use-vulkan \
    --enable-zero-copy \
    --ignore-gpu-blocklist \
    --check-for-update-interval=604800 \
    --no-sandbox --no-zygote --test-type --v=0 "$@"
 
Sorry if my words sounded like those of a know-it-all, which I am not. I have often said that I am not. My intent in communicating was to try to improve the Napoleon's already excellent work. Usually repeating a configuration step by step allows to eliminate errors. That's all.
 
Back
Top