jails Running 8.4 in a jail?

spork

spork

First off - I'm aware that one should not do that. However, I want to do that and I fully understand the risks involved in keeping something like this running. That said, you can be assured it lives in an isolated network and it doesn't even need to reach the internet to function. The software it runs (Postgres, Apache 22 w/mod_perl, and an extremely bespoke and convoluted perl web-app) will never be updated, is proprietary, and the author has been MIA for at least 5 years.

That said, I have some experience with old jails because I work with a lot of strange people with strange demands. I've had a 4.11 jail under FreeBSD 12.x(!!!). I've had multiple 8.4 jails under FreeBSD 13.x. Don't ask.

It appears that in FreeBSD 15, this is no longer possible. You can run an 8.4 jail, but don't expect networking is kind of what I think I'm seeing here. Any daemon that tries to bind to an IP just fails. As expected, 'netstat' and 'ifconfig' in the jail aren't doing well, but bringing "/rescue" in from the host I see that running a static 'ifconfig' in the jail shows that it indeed does not seem to see an IP:

Code: 
[root@ben /rescue-15]# ./ifconfig bge0
bge0: flags=1008943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
    options=c0099<RXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,VLAN_HWTSO,LINKSTATE>
    ether 30:8d:99:cc:d9:9c
    media: Ethernet autoselect (1000baseT <full-duplex>)
    status: active
[root@ben /rescue-15]#

Yet out in the host, jls is at least indicating an IP is assigned to the jail (JID 22 - this is just a simple jail.conf-based jail, no iocage, bastille, etc. and not using VNET/VI)

Code: 
[root@tank /rescue]# jls
   JID  IP Address      Hostname                      Path
     3                  private                       /tank/iocage/jails/private/root
    17  10.3.2.12       share                         /tank/iocage/jails/share/root
    22  10.3.2.10       ben                           /tank/hoststuff/jails/ben
    25  10.3.2.7        booty                         /tank/iocage/jails/booty/root

I'm not saying this should work or anything, I'll likely have to get a 13.x bhyve VM going and then put this in a jail in that VM since bhyve can no longer boot legacy BIOS, but I am curious what kind of changes resulted in really old jails like this losing the ability to have network access.
 
jls only reads back the jail parameter, it doesn't tell you the address exists. If ifconfig on the host shows no address, the alias was never created, and that's a host-side problem rather than anything the 8.4 userland does.

Two things to check. First, how the address is supposed to be created: jail(8) only configures it itself if you set the interface parameter, or write ip4.addr as iface|addr/prefix. Without that it assumes the address already exists on the host, so if it used to come from an ifconfig_<iface>_alias line in rc.conf, verify that line still matches. Second, whether the interface still has the same name after the upgrade, since a driver change would silently orphan that alias.

FWIW the ABI angle is a dead end: 15.0 GENERIC still has COMPAT_FREEBSD4 through COMPAT_FREEBSD14, so the old syscalls are still there.

Separately, your own bhyve idea is the sounder long-term answer. A jail shares the host kernel, so every host upgrade puts that userland at risk again; a VM lets you pin the whole system and stop worrying about it.
 
You must log in or register to reply here.
Back
Top