This is starting to touch on why I choose to do things the way I do them (-e.g. my jail script vs others) and I'm interested in how you're going to tackle these types of things. Tell us how it goes (obviously, UID--for example--is easy, but I want to see how you're going to tackle these types of "issues" in an automated setup). Very cool to watch! Keep going.
# 1. host user
root@fbsdhost4:/home/toddg # grep backup /etc/passwd
backup:*:2001:2001:User &:/home/backup:/bin/sh
# 2. jail user
root@fbsdhost4:/home/toddg # jexec -l backitup grep backup /etc/passwd
backup:*:2001:2001:User &:/home/backup:/bin/sh
# 3. host datasets / filesystems are chowned to backup:backup
root@fbsdhost4:/home/toddg # ls -lsat /opt
total 21
17 drwxr-xr-x 23 root wheel 28 Feb 17 21:23 ..
1 drwxr-x--- 4 backup backup 4 Feb 14 12:41 prod
1 drwxr-x--- 5 backup backup 5 Feb 14 12:41 .
1 drwxr-x--- 4 backup backup 4 Feb 14 12:41 stage
1 drwxr-x--- 4 backup backup 4 Feb 14 12:41 dev
root@fbsdhost4:/home/toddg # ls -lsat /opt/dev
total 4
1 drwxr-x--- 5 backup backup 5 Feb 14 12:41 ..
1 drwxr-x--- 4 backup backup 4 Feb 14 12:41 .
1 drwxr-x--- 2 backup backup 2 Feb 14 12:41 postgres
1 drwxr-x--- 2 backup backup 2 Feb 14 12:41 feeds
root@fbsdhost4:/home/toddg # ls -lsat /opt/dev/feeds/
total 2
1 drwxr-x--- 4 backup backup 4 Feb 14 12:41 ..
1 drwxr-x--- 2 backup backup 2 Feb 14 12:41 .
root@fbsdhost4:/home/toddg # ls -lsat /opt/dev/postgres/
total 2
1 drwxr-x--- 4 backup backup 4 Feb 14 12:41 ..
1 drwxr-x--- 2 backup backup 2 Feb 14 12:41 .
# 4. root user inside jail can see the files
root@fbsdhost4:/home/toddg # jexec -l backitup find /opt
/opt
/opt/prod
/opt/prod/postgres
/opt/prod/feeds
/opt/dev
/opt/dev/postgres
/opt/dev/feeds
/opt/stage
/opt/stage/postgres
/opt/stage/feeds
/opt/stage/feeds/fakefeed.txt
# 5. the backup user inside the jail cannot see the files
root@fbsdhost4:/home/toddg # jexec -l -u backup backitup find /opt
/opt
find: /opt/prod: Permission denied
find: /opt/dev: Permission denied
find: /opt/stage: Permission denied
find: /opt: Permission denied
# 6. trying with both the "-u" and "-U" flags, same result
root@fbsdhost4:/home/toddg # jexec -l -U backup backitup find /opt
/opt
find: /opt/prod: Permission denied
find: /opt/dev: Permission denied
find: /opt/stage: Permission denied
find: /opt: Permission denied
host (/var/db/repositories/):
drwxr-s--- 9 211 wheel 9 Jan 25 15:25 server/
jail (/var/db/git/):
drwxr-s--- 9 git wheel 9 Jan 25 15:25 server/# 1. create fresh new dataset
root@fbsdhost4:/home/toddg # zfs create -o mountpoint=/fubar zroot/fubar
# 2. populate it with a file
root@fbsdhost4:/home/toddg # touch /fubar/somefile.txt
# 3. chown to the user I'll be using in the jail
root@fbsdhost4:/home/toddg # chown -R backup:backup /fubar/
# 4. verify file perms
root@fbsdhost4:/home/toddg # ls -lsat /fubar/
total 19
1 drwxr-xr-x 2 backup backup 3 Feb 17 22:54 .
1 -rw-r--r-- 1 backup backup 0 Feb 17 22:54 somefile.txt
17 drwxr-xr-x 24 root wheel 29 Feb 17 22:53 ..
# 5. update the jail's fstab to mount this new dataset
root@fbsdhost4:/home/toddg # vim /jails/fstab/backitup.fstab
>>> /fubar /jails/containers/backitup/fubar nullfs rw 0 0
# 6. make the mount point in the jail
root@fbsdhost4:/home/toddg # jexec -l backitup mkdir /fubar
# 7. restart the jail to reload the fstab
root@fbsdhost4:/home/toddg # service jail restart backitup
Stopping jails: backitup.
Starting jails: backitup.
# 8. drumroll....
root@fbsdhost4:/home/toddg # jexec -l backitup ls /fubar
somefile.txt
# 9. Ok, so that worked
root@fbsdhost4:/home/toddg # jexec -l backitup cat /fubar/somefile.txt
# 10. add some text to the file
root@fbsdhost4:/home/toddg # vim /fubar/somefile.txt
# 11. cat it out
root@fbsdhost4:/home/toddg # jexec -l backitup cat /fubar/somefile.txt
snthaoeusnth
sanoteusatheu
snth# 1. remove the backup user from HOST
root@fbsdhost4:/home/toddg # rmuser backup
Matching password entry:
backup:...
Is this the entry you wish to remove? (yes/no): y
Remove user's home directory? [/home/backup] (yes/no): y
Removing user (backup): mailspool home passwd.
# 2. verify files on the HOST use the correct UID (in this case 2001)
root@fbsdhost4:/home/toddg # ls -lsat /fubar/
total 19
1 drwxr-xr-x 2 2001 2001 3 Feb 17 22:56 .
1 -rw-r--r-- 1 2001 2001 33 Feb 17 22:56 somefile.txt
17 drwxr-xr-x 24 root wheel 29 Feb 17 22:53 ..
# 3. verify that the jail root user can see the files
root@fbsdhost4:/home/toddg # jexec -l backitup cat /fubar/somefile.txt
snthaoeusnth
sanoteusatheu
snth
# 4. verify that the HOST user cannot do anything (it's been deleted)
root@fbsdhost4:/home/toddg # jexec -l -u backup backitup cat /fubar/somefile.txt
jexec: backup: no such user
# 5. verify that the JAIL user can see the files
root@fbsdhost4:/home/toddg # jexec -l -U backup backitup cat /fubar/somefile.txt
snthaoeusnth
sanoteusatheu
snthzroot/SAFE[zroot/SAFE]
recursive = yes
[zroot/SAFE/dev]
use_template = dev
[zroot/SAFE/stage]
use_template = stage
[zroot/SAFE/prod]
use_template = prod- name: create a new dataset called zroot/SAFE
community.general.zfs:
name: zroot/SAFE
state: present
extra_zfs_properties:
canmount: off
mountpoint: "/opt"
# dev
- name: create a new dataset called zroot/SAFE/dev
community.general.zfs:
name: zroot/SAFE/dev
state: present
extra_zfs_properties:
canmount: off
mountpoint: "/opt/dev"
- name: create a new dataset called zroot/SAFE/dev/feeds
community.general.zfs:
name: zroot/SAFE/dev/feeds
state: present
- name: create a new dataset called zroot/SAFE/dev/postgres
community.general.zfs:
name: zroot/SAFE/dev/postgres
state: present
backitup {
$id = "10";
###
# all of this can be moved to /etc/jail.conf
# .....................>%
$ipaddr = "10.0.0.${id}";
$mask = "255.255.255.0";
$gw = "10.0.0.1";
vnet;
vnet.interface = "epair${id}b";
exec.prestart = "ifconfig epair${id} create up";
exec.prestart += "ifconfig epair${id}a up descr vnet-${name}";
exec.prestart += "ifconfig bridge0 addm epair${id}a up";
exec.start = "/sbin/ifconfig lo0 127.0.0.1 up";
exec.start += "/sbin/ifconfig epair${id}b ${ipaddr} netmask ${mask} up";
exec.start += "/sbin/route add default ${gw}";
exec.start += "/bin/sh /etc/rc";
exec.prestop = "ifconfig epair${id}b -vnet ${name}";
exec.poststop = "ifconfig bridge0 deletem epair${id}a";
exec.poststop += "ifconfig epair${id}a destroy";
# .....................>%
###
persist;
}myjail {
$id = "63";
}
github.com
| task | command | notes |
| destroy the datasets | HOST (root)# zfs destroy -r zroot/SAFE | nuke the planet from orbit |
| rm the mount points | HOST (root)# rm -rf /opt | same |
| ensure everything is clean, e.g. no datasets and directory /opt does not exist | HOST (root)# find /opt | until i did this, i definitely got confusing results |
| create the datasets | HOST (root)# zfs create -o canmount=off -o mountpoint=/opt zroot/SAFE | see below for further discussion on this |
| populate the datasets with some test data | HOST (root)# touch /opt/dev/feeds/feed1.txt | repeat as nec |
| verify that the HOST(root) account can see the data | HOST (root)# find /opt | |
| verify that the JAIL(root) account can see the data | HOST (root)# jexec -l find /opt | |
| verify that the JAIL(root) account can see the data | HOST (root)# jexec -l -U backup find /opt | |
2026-02-18.00:00:33 zfs create -p -o canmount=off -o mountpoint=/opt zroot/SAFE
2026-02-18.00:00:33 zfs create -p zroot/SAFE/dev
2026-02-18.00:00:34 zfs create -p zroot/SAFE/dev/feeds
2026-02-18.00:00:35 zfs create -p zroot/SAFE/dev/postgres
2026-02-18.00:00:35 zfs create -p zroot/SAFE/stage
2026-02-18.00:00:36 zfs create -p zroot/SAFE/stage/feeds
2026-02-18.00:00:36 zfs create -p zroot/SAFE/stage/postgres
2026-02-18.00:00:36 zfs create -p zroot/SAFE/prod
2026-02-18.00:00:36 zfs create -p zroot/SAFE/prod/feeds
2026-02-18.00:00:37 zfs create -p zroot/SAFE/prod/postgres2026-02-18.19:53:36 zfs create -o canmount=off -o mountpoint=/opt zroot/SAFE
2026-02-18.19:53:36 zfs create -o canmount=off zroot/SAFE/dev
2026-02-18.19:53:36 zfs create -o canmount=off zroot/SAFE/stage
2026-02-18.19:53:36 zfs create -o canmount=off zroot/SAFE/prod
2026-02-18.19:54:12 zfs create zroot/SAFE/dev/file
2026-02-18.19:54:12 zfs create zroot/SAFE/dev/db
2026-02-18.19:54:12 zfs create zroot/SAFE/stage/file
2026-02-18.19:54:12 zfs create zroot/SAFE/stage/db
2026-02-18.19:54:12 zfs create zroot/SAFE/prod/file
2026-02-18.19:54:12 zfs create zroot/SAFE/prod/db -p Creates all the non-existing parent datasets. Datasets created in
this manner are automatically mounted according to the mountpoint
property inherited from their parent. Any property specified on
the command line using the -o option is ignored. If the target
filesystem already exists, the operation completes successfully.I'm still new so I'm not 100pct sure either, but I'd say here (keeps things nice and tidy) if you ask me.
Reading this thread with fascination, as I'm also getting started in bootstrapping a new infrastructure that'll revolve around heavy use of jails, and I'm very pro infrastructure as code, I wanted to add my two cents that I'm not sure if they'll be useful to your Ansible workflow, but hopefully you'll still find it interesting.
rc.conf being mutated by multiple tasks, be aware that you can always spread your rc configuration out to multiple files. For example, most of my rc configurations are not even in /etc/rc.conf to begin with, but in /usr/local/etc/rc.conf.d, and within that, if I'm configuring separate services, e.g. GitLab & nginx, each of them gets its own configuration file:-> sysrc -f /usr/local/etc/rc.conf.d/gitlab gitlab_enable="YES"
-> sysrc -f /usr/local/etc/rc.conf.d/nginx nginx_enable="YES"Like I said in an earlier post, I'm also working on fleshing out a new piece of infrastructure that'll revolve around heavy use of jails, and, among them, I'm looking to deploy a few that will be writing critical data to their local filesystems, e.g. databases, so I'm obviously concerned about the data backup problem, and have been weighing some options:
emby {
...
# Self healing; restart the jail if the `dotnet` process stops.
exec.poststart += "if [ -f /opt/scheduler/cron/emby.crontab ]; then cp /opt/scheduler/cron/emby.crontab /etc/cron.d/emby.crontab; fi";
exec.prestop += "if [ -f /etc/cron.d/emby.crontab ]; then rm /etc/cron.d/emby.crontab; fi";
...
}jmpalacios
Thank you, super useful thread!jmpalacios
Here's a link to a thread that discusses your exact question.
See patmaddox 's comments in that thread.
[server:~]cat /etc/jail.conf
# DEFAULT OPTIONS
# (COMMON TO ALL JAILS)
# STARTUP/LOGGING
# ...
# PERMISSIONS
allow.raw_sockets;
exec.clean;
mount.devfs;
devfs_ruleset = 5;
# PATH/HOSTNAME
path = "/usr/local/jails/containers/${name}";
host.hostname = "${name}";myjail {
$id = 777;
# MOUNTS
mount += "/media/Data $path/mnt/Media/Data nullfs rw 0 0";
} # MOUNTS<br> mount += "/media/Data $path/mnt/Media/Data nullfs rw 0 0";backitup {
$id = "10";
mount += "/opt/dev/file /jails/containers/backitup/opt/dev/file nullfs ro 0 0";
}root@fbsdhost4:/home/toddg # service jail start backitup
Starting jails: cannot start jail "backitup":
mount_nullfs: /jails/containers/backitup/opt/dev/file: Resource deadlock avoided
jail: backitup: /sbin/mount -t nullfs -o ro /opt/dev/file /jails/containers/backitup/opt/dev/file: failed
.# Devices usually found in a jail.
#
[devfsrules_jail=4]
add include $devfsrules_hide_all
add include $devfsrules_unhide_basic
add include $devfsrules_unhide_login
add path fuse unhide
add path zfs unhide
[devfsrules_jail_vnet=5]
add include $devfsrules_hide_all
add include $devfsrules_unhide_basic
add include $devfsrules_unhide_login
add include $devfsrules_jail
add path pf unhide
sudo pkg --chroot [/jails/containers/foo_jail] install my_custom_package-1.0.0
www.siberoloji.com
sudo mkdir -p /opt/builds
cp my_custom_package-1.0.0.pkg /opt/builds/.
cd /opt/builds
pkg repo .
mkdir -p /usr/local/etc/pkg/repos/local: {...