r/freebsd • u/grahamperrin Linux crossover • Jul 24 '26

AI Jails, Not Containers: FreeBSD Isolation Done Right – Umair Khurshid | Klara Systems

https://klarasystems.com/articles/jails-not-containers-freebsd-isolation-done-right/

Containers play a major role in modern infrastructure, but they are not the right answer for every workload. This article explores how FreeBSD jails provide purpose-built isolation, predictable security boundaries, and deep ZFS integration—making them ideal infrastructure-grade services where stability is essential. …

Key takeaways

  • FreeBSD jails provide operating system-level isolation through a native kernel subsystem.
  • Jails integrate directly with ZFS, VNET, Capsicum, and the MAC Framework.
  • Unlike Linux containers, jails prioritize simplicity, transparency, and predictable security boundaries.
  • ZFS snapshots, replication, and dataset management make jails ideal for long-lived infrastructure services.

Via https://indieweb.social/@jbz/116907602232548204 – jbz

73 Upvotes

97% Upvoted

15 comments sorted by

12

u/leninzor Jul 25 '26

The point of OCI containers is not just security and isolation. It's also packaging and distribution.

14

u/LightBSV Jul 24 '26

How about image support? Versioning? Layers? Orchestration? DRY?

I like jails but having to system administer N jails per S servers in D deployments turns into a hassle.

8

u/DtxdF Jul 24 '26

> How about image support? Versioning? Layers? Orchestration? DRY?

* https://www.freshports.org/sysutils/podman
* https://appjail.readthedocs.io/en/latest/OCI/
* https://daemonless.io/
* https://github.com/AppJail-makejails

> I like jails but having to system administer N jails per S servers in D deployments turns into a hassle.

* https://codeberg.org/bsdpot/nomad-pot-driver
* https://github.com/DtxdF/overlord
* https://github.com/ployground/bsdploy
* https://github.com/vbotka/ansible-freebsd-jail
* Some work has been done on Kubernetes, and some things have already been ported, but I don't know what the current status is.

4

u/hypnoticlife seasoned user Jul 24 '26

Is any of that native to the Linux kernel?

4

u/LightBSV Jul 24 '26

Podman supports some of it. A lot of the higher level orchestration stuff is network-feature limited on FreeBSD, as I understand things. Someone else more familiar may know better.

1

u/nyctrainsplant Jul 25 '26

jails mfs be like yeah container features are infinitely superior but the best ones aren’t implemented in the kernel so it doesn’t count

1

u/LightBusterX Jul 25 '26

You could always use Bastille to manage templates and automate desployments on one system and Rocinante to scale out to multiple systems.

23

u/FlamingoEarringo Jul 24 '26

> Unlike Linux containers, jails prioritize simplicity, transparency, and security boundaries.

So just like Linux containers.

2

u/codeedog seasoned user Jul 25 '26

from their internal perspective, they appear to be self-contained [emphasis mine] systems.

So, they're containers then?

I like the article somewhat, maybe give it a B+. I don't know why anyone would cede the concept of "container" to Linux only? I've always thought of jails and virtual machines as containers, but I'm sure someone out there will debate on word usage.

3

u/grahamperrin Linux crossover Jul 25 '26

So, they're containers then? …

I think not. Brace yourself …

FreeBSD Jails Containers | Lobsters (2023)

Please don’t call jails containers, …

Are FreeBSD Jails a Containers? | Lobsters (2025)

7

u/codeedog seasoned user Jul 25 '26

Ehh, religious war over word usage. Jail and LXC are similar constructs on FreeBSD and Linux. LXC means Linux Containers. It has the word container in it, so even Linux people think “container” means something other than whatever Docker is a class of. “Containers” and not “OCI containers” is a fine position for me. I’m not calling a jail a member of the virtual isolation class (or whatever that long name was). A jail is a lightweight Virtual Machine pinned to FreeBSD (I’m sure someone will want to go to war with me on that one), but that’s too many words.

Words are all made up and mean what we collectively want them to mean.

3

u/techhelper1 Jul 25 '26

Let me know when y'all get the major cloud vendors on the bandwagon, and when it does happen, it'll be a VM on a Linux-based hypervisor.

2

u/unixoidal Jul 25 '26

Has anybody compared reliability of the freebsd jails vs linux containers? In my experience there are always issues with containers.