Solved Poudriere work with service jail.

[epopen]

Hi All

I'm studying ports-mgmt/poudriere and apply to base system and network service jail.

About service jail, description as follows

• Network service like www/apache24 / ftp/vsftpd daemon etc...
  Installed with independent service jail separately.
• Common service like security/openssh-portable
  Installed all of independent service jail.

Based above service jail, I think about ports-mgmt/poudriere build jail model.

1. One of ports-mgmt/poudriere build jail for common service.
   Several of ports-mgmt/poudriere build jail pair with several independent service jail.
2. One of ports-mgmt/poudriere build jail for common service.
   One of ports-mgmt/poudriere build jail (Build all of network daemon) for several independent service jail.
3. One of ports-mgmt/poudriere build jail with build ALL of Network service/daemon and Network Common service/daemon for several independent service jail.

Please correction / suggestion better model.
Thanks all very much.

 

[SirDice]

Common service like security/openssh-portable

sshd(8) is included with the base OS, so why install the port/package?

And why are you running multiple Poudriere instances when everything can be built with a single instance? Or am I misunderstanding your ideas? Just build everything you need in a single instance, then 'share' that resulting repository to all your jails.

In my homelab I have about 12 VMs running with various services. There's only one server building packages with poudriere. The resulting repository is shared to all my VMs.

 

[epopen]

sshd(8) is included with the base OS, so why install the port/package?

Because ports version update earlier than base OS.
Other common service add future possible.

And why are you running multiple Poudriere instances when everything can be built with a single instance? Or am I misunderstanding your ideas? Just build everything you need in a single instance, then 'share' that resulting repository to all your jails.

In my homelab I have about 12 VMs running with various services. There's only one server building packages with poudriere. The resulting repository is shared to all my VMs.

Currently, I build all of ports in base OS, but saw library conflict between ports at other thread before...
So, taking this opportunity, separate by service jail.

Follows your answer, take 3. One of ports-mgmt/poudriere build jail (equal instances?) with build ALL of Network service/daemon and Network Common service/daemon for several independent service jail is equal and well?

Thanks you.

 

[SirDice]

Because ports version update earlier than base OS.

Irrelevant as long as the base version gets its security patches.

Currently, I build all of ports in base OS, but saw library conflict between ports at other thread before...

Poudriere (and Synth too) use a "clean room" approach, they start with an empty jail, there's no 'older' versions of anything to contend with.

3. One of ports-mgmt/poudriere build jail (equal instances?) with build ALL of Network service/daemon and Network Common service/daemon for several independent service jail is equal and well?

Yes. I use one build jail for each version of FreeBSD. Packages are built for each specific version.

root@chibacity:/usr/local/etc/poudriere.d # poudriere jail -l
JAILNAME    VERSION             OSVERSION ARCH  METHOD       TIMESTAMP           PATH
143-release 14.3-RELEASE-p6     1403000   amd64 http         2025-12-06 23:47:09 /usr/local/poudriere/jails/143-release
150-release 15.0-RELEASE        1500068   amd64 http         2025-12-06 23:48:39 /usr/local/poudriere/jails/150-release
15-stable   15.0-STABLE 1500503 1500503   amd64 src=/usr/src 2025-12-06 23:44:47 /usr/local/poudriere/jails/15-stable

 

[epopen]

Irrelevant as long as the base version gets its security patches.


Yes. I use one build jail for each version of FreeBSD. Packages are built for each specific version.

root@chibacity:/usr/local/etc/poudriere.d # poudriere jail -l
JAILNAME    VERSION             OSVERSION ARCH  METHOD       TIMESTAMP           PATH
143-release 14.3-RELEASE-p6     1403000   amd64 http         2025-12-06 23:47:09 /usr/local/poudriere/jails/143-release
150-release 15.0-RELEASE        1500068   amd64 http         2025-12-06 23:48:39 /usr/local/poudriere/jails/150-release
15-stable   15.0-STABLE 1500503 1500503   amd64 src=/usr/src 2025-12-06 23:44:47 /usr/local/poudriere/jails/15-stable

I got it, thanks your suggestion

 

[SirDice]

Those jails are sort of like a 'base' jail, each worker makes a copy of that base jail then starts building. Once the build is finished that 'worker' jail is destroyed, and new 'worker' jail is copied (using ZFS clone) and a new build is started inside of it. This goes on until everything is done.

Depending on the size of your system you can have multiple 'worker' jails running, each with its own independent job. You don't have to do this yourself, it's all done 'automagically'.

 

[epopen]

Those jails are sort of like a 'base' jail, each worker makes a copy of that base jail then starts building. Once the build is finished that 'worker' jail is destroyed, and new 'worker' jail is copied (using ZFS clone) and a new build is started inside of it. This goes on until everything is done.

Depending on the size of your system you can have multiple 'worker' jails running, each with its own independent job. You don't have to do this yourself, it's all done 'automagically'.

Ouch! I'm sorry, I found my fault
Please replace "ports-mgmt/poudriere build jail" in my previous post with instances/workers.

Follows is my current a jail for all instances/workers

JAILNAME      VERSION      ARCH  METHOD TIMESTAMP           PATH
14_epopenXcom 14.3-RELEASE amd64 http   2025-10-24 23:59:42 /usr/local/poudriere/jails/14_epopenXcom

About mentioned library conflict between ports
I hit the problem in my service jail of mail before 1 year...

Dec  9 09:00:24 mail imapd-ssl[54751]: ip=[fd00::ffff:a00:3fe], couriertls: /usr/local/etc/courier-imap/certificate/epopen.com/fullchain.pem: error:1E08010C:DECODER routines::unsupported

Official forum replied "library conflict" I remember...
This is reason of "taking this opportunity, separate by service jail".
Example, content of -f pkglist file for service jail of http.

databases/memcached
databases/pecl-memcached
www/apache24

Content of -f pkglist file for service jail of problem mail.

mail/courier-imap
mail/opendkim
mail/postfix

Is One of ports-mgmt/poudriere build jail instances/worker with build ALL of Network service/daemon and Common service/daemon for several independent service jail. well still?

Thanks you.