Configure Poudriere Jail

F

freebuser

Hi All,

I just started to use Poudriere to compile packages for my jails.

My host IP = 10.0.0.*
My jail IP's = 192.168.1.*

I like to share the packages via Poudriere jail, for this I believe I need to change the IP of Poudriere jail to match with other Jail IP's.

Can someone please help me on how to set up the IP for Poudriere jail or what other options I have to update the packages in jails.

Thanks with regards,
 
You want to do it the other way by nullfs(5) mounting the package directory of the host to the jails.

# mount_nullfs /usr/local/poudriere/data/packages/<jailname>-default /path/to/jailroot/usr/ports/packages

I'm sure ezjail offers option to automate that mount on jail startup, I just haven't used it so I can't advise on that.

The other way would be to share the host's package directory via a web server and allow the jails to access that web server.
 
You can also install nginx for example and "share" the packages that way. Another way is to set your path like this:
Code: 
dicelan-desktop: {
    url: file:///usr/local/poudriere/data/packages/11-desktop-default/
    mirror_type: none
    enabled: yes
}

dicelan-server {
    url: file:///usr/local/poudriere/data/packages/11-server-default/
    mirror_type: none
    enabled: yes
}

I test different types of packages on this machine, it also builds them. You can use the nullfs(5) trick kpa showed to mount the poudriere package directory on the host or on other jails.
 
Thanks kpa / SirDice,

As I mentioned on my post the host and jails are in different subnets. I think I need to modify the pf.conf to redirect requests from jail to host for either methods nginx or file://.

Thanks
 
If you use file:// it will use the local filesystem. As this won't use the network a firewall would be irrelevant. If you go the http:// route then of course you need to allow access from the jails.
 
Depending on your setup you won't need any redirections to allow the jails to access the web server running on the host. As long as you have IP forwarding on there will be access across the different subnets/interfaces if your PF rules allow the connections in the first place.
 
I think I clearly missing something here:

SirDice: My understanding of jails is it cannot access to file system in the host, thus the configuration with file:// inside the jail won't be useful as the path won't be inside the jail.

kpa: As both the jails and the host are on the same computer (I have only one FreeBSD server so there are no other jails/hosts to update in the whole network) it my understanding that pf.conf is the only way that I can set up IP forward.

Thanks
 
freebuser said:
SirDice: My understanding of jails is it cannot access to file system in the host, thus the configuration with file:// inside the jail won't be useful as the path won't be inside the jail.
Click to expand...
True, but you can use nullfs(5) to mount that filesystem on other jails.

Kpa: As both the jails and the host are on the same computer ( I have only one FreeBSD server so there are no other jails/hosts to update in the whole network) it my understanding that pf.conf is the only way that I can set up IP forward.
Click to expand...
PF doesn't forward the traffic. It's done with the gateway_enable setting. PF uses the routing capabilities of the host it runs on.
 
Although I came across gateway_enable before, I didn't really pay much attention to it.

I will go through this and see how I can improve my setup.

EDIT: Not sure how you got that green letters
 
freebuser said:
I think I clearly missing something here:

Kpa: As both the jails and the host are on the same computer ( I have only one FreeBSD server so there are no other jails/hosts to update in the whole network) it my understanding that pf.conf is the only way that I can set up IP forward.

Thanks
Click to expand...

You can set up FreeBSD as a fully working router without using any kind of packet filter. It won't be able to do any filtering or address rewriting but it will work as long as all IP addresses used are routable. As SirDice above wrote the ability to forward IP packets between interfaces is controlled only by gateway_enable setting in rc.conf(5) (ipv6_gateway_enable for IPv6) that turns on the net.inet.ip.forwarding sysctl(8) that is the actual control for IP forwarding.
 
You must log in or register to reply here.
Back
Top