I'd very strongly suggest running bhyve in jail for multi-tenancy - either one jail for every tenant or even a dedicated one for each jail and tying them together per-tenant in the backend you will most likely create/run on top.
With bhyve in jails you can keep the host as vanilla as possible and put all your special configuration and all you need to connect your backend in a (very stripped and locked down) jail template which is just cloned and spun up for every instance. Additionally *if* there should ever be any bug in bhyve that allows breaking out of the hypervisor, an attacker would only find himself in a heavily restricted jail...
The same approach is done by e.g. smartOS with bhyve and KVM running in zones and IIRC ClonOS is also running bhyve in jails.
bhyve can only be run as root at the moment, but that doesn't mean your API needs to run as root. See how it's done in CBSD: API ( /usr/ports/sysutils/cbsd-mq-api ) can run from unprivileges user's, but executor ( /usr/ports/sysutils/cbsd-mq-router ) must have 'root' privileges). I still plan to integrate this API into ClonOS.
As for bhyve in jail + ClonOS: CBSD (used by ClonOS) had this option, but I'll change that to chroot(1) soon.
I get your point and the idea for the zones is something I am going to think about
usability over security I always say. and I work security
not a fan of patching all those jails with VMs running on top
here is the plan:
bHype will (eventually) turn a fresh installation of FreeBSD 13.1+ into a standalone virtual machine host that can be maintained within a corporate environment. - GitHub - bozhinov/bHype: bHype wil...
Hey Ole, long time. Thank you for the link. I have already thoroughly explored CBSD and ClonOS. I am a fan as you know.
I may need your help with OS packaging later on. I see FreeBSD provides several options and as always none of them are properly documented.
Hey Ole, long time. Thank you for the link. I have already thoroughly explored CBSD and ClonOS. I am a fan as you know.
I may need your help with OS packaging later on. I see FreeBSD provides several options and as always none of them are properly documented.
This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
By continuing to use this site, you are consenting to our use of cookies.
github.com
! But i'm still trying to fix what you broke in ClonOS, haha! But I like the initiative.
