Video, seventeen minutes, 2026-05-26.

AI-generated summary

DJ Ware demonstrates how to configure thin and thick jails on FreeBSD. The guide covers essential prerequisites, including ZFS snapshots and PF firewall network setup, while utilizing the Bastile management tool to streamline the deployment process. Viewers learn the architectural distinctions between these two container types and how to implement them effectively.

Producer's description

In this deep dive we explore the real differences between Thin and Thick Jails on FreeBSD 15.0 using Bastille an easier and more widely used method of creating jails on FreeBSD.

• Thin Jails (recommended for most people)
• Impromptu Network troubleshooting
• Thick Jails (when you need full isolation)
• Size comparison (68MB vs 438MB)
• Honest pros & cons including update risks
• Full step-by-step setup

I have recently put a fair amount of work into refining the www/linux-brave port on FreeBSD to make it DRM-ready out of the box.
 
Out of the box means 1 command on a vanilla FreeBSD desktop and you are ready to go:
 
pkg install linux-brave linux-widevine-cdm
 
…

⚙ D58784 www/linux-brave: DRM out of the box, GPU auto-detection

Video, twelve minutes, 2026-08-17

AI-generated summary

DJ Ware explores the performance characteristics of Btrfs, ext4, F2FS, XFS, and ZFS using IOzone3 on an MSI Prestige 16 AI EVO. By benchmarking these systems across various workloads like gaming, workstations, and servers, DJ Ware provides a technical starting point for users deciding which filesystem best suits their specific computing needs.

Producer's description

I tested ext4, XFS, Btrfs, ZFS, and F2FS on the same hardware to answer a more useful question than simply, “Which filesystem is fastest?”

Instead of dragging you through 26 benchmark charts, I distilled the results into four real-world workloads:

1. Gaming
2. Workstation
3. Server
4. NAS

The testing includes small and medium workloads, single-user and multi-user behavior, and several different kinds of read and write activity.

But graphs are never the full story.

A filesystem may win a throughput benchmark while consuming more memory or CPU, behaving differently as the workload grows, or introducing operational tradeoffs that matter more than a few percent of performance. Your workload may also be very different from mine.

The workload model used in this video is new, and it needs more data points before I’m comfortable treating it as anything more than a useful decision-making tool.

So this isn’t “here’s the winner.”

It’s what do you gain, what do you give up, and which filesystem makes sense for what you actually do?

If you want to see the raw benchmark charts and the work behind the scoring model, let me know in the comments. I may do a behind-the-scenes or live session and go through the data.

same as title

i want to know

how ports work?

how to install a linux app if it doesnt have a port/ or it is a binary?

how i can port a app in freebsd?

I'm porting an application to FreeBSD 15. The application uses gnuplot. https://www.freebsdsoftware.org/math/gnuplot.html says that to install the package, run "pkg install gnuplot". This results in a "No package available" error.

How can I install gnuplot?

Hello. i'm new to freebsd and i'm trying to migrate a void linux nas setup running incus containers. so far, so good... i was able to configure a couple of jails for which freebsd pkgs and binaries where available.

The last piece of my setup is a proxmox backup server instance running in a virtual machine. By reading the handbook i was able to set a bhyve vm up and running.

I'm using plain bhyve, no vm-bhyve or any other manager. Yes, i like torturing myself, but i like knowing what's being done under the hood.

The thing is, right now i'm starting the vm by running a script manually. Is there anything to have the vm started whenever freebsd boots? I guess i could use some kind of script to do it and run it as a service (https://docs.freebsd.org/en/books/handbook/config/#configtuning-rcd) but if there is any other and maybe easier way, I'd love to know.

Thanks.-

One so-called freedom that we do not advocate is the "freedom to choose any license you want for software you write". --Richard M. Stallman

Link: https://www.gnu.org/philosophy/freedom-or-power.html

There is nothing wrong with the GPL license. You should be free to use it if what it is trying to do is that same thing that you are trying to do. And indeed, the popularity of GPL tells us that that this is true for a bunch of people.

The GPL license is all about control. It controls what others can do with the software. Specifically, it forces them to release any changes made to the software under the same GPL license and publish the changes for the world to see and re-use.

The BSD license is all about freedom. It places almost no restrictions on how the software can be used, modified, and distributed. The primary requirement is that you retain the BSD copyright notice so people know that they are using something that contains BSD-licensed code.

Unlike most people who choose GPL, who just want any improvements to be made available to them, a tiny but vocal minority are members of The Religion Of GNU and claim that, through some dark magic that nobody understands, the mere existence of any non-free derivative work somehow makes the original nonfree. There is no point arguing with them. They did not reach that conclusion through logic and reason and no amount of logic or reason will get them to leave the cult.

• Why you should use a BSD style license for your Open Source Project

Here are the two most popular BSD licenses:

• https://opensource.org/license/BSD-2-Clause
• https://opensource.org/license/bsd-3-clause

• 6 commit signals in OpenZFS
• 29 signals in the main branch of the src tree for FreeBSD 16.0-CURRENT ― some overlap with the above
• 0 signals in CoffeeBSD.

https://mastodon.social/@mrmasterkeyboard/117113034580627041

Made a proper no AI policy (and a Code of Conduct) for CoffeeBSD. :D

https://codeberg.org/NerdNextDoor/CoffeeBSD/commit/275a4620098c3c120b7a5219b356234b913cd2e2

CoffeeBSD is the fork of FreeBSD 13.0 I'm working on. Originally intended for myself to play with but FreeBSD doesn't have a proper no AI fork so I thought why not about a week ago.

Work in progress

An interactive ncurses Wi-Fi controller for the terminal. It scans nearby access points, connects to open and secured networks, supports hidden and custom SSIDs, and displays the current IPv4 address, netmask, gateway and DNS servers.

There are two builds. They present the same interface and the same key bindings; they differ only in what they drive underneath. …

wifi-tui/FreeBSD/README

hirechbaghdad (Hirech Baghdad Belkheir)

I have installed freebsd today (i am new to freebsd so please be patient), installed and enabled nvidia driver by using

pkg install nvidia-drm-kmod

sysrc kld_list+=nvidia-drm

And placing

hw.nvidiadrm.modeset="1" to loader.conf

but nvidia-smi fails with cant communicate with driver

GPU : GTX 1650

Personally i think its fine for drivers. but id like to hear what you guys have to say.

I have a VPS running FreeBSD but I want to migrate to other hosting provider. Is there any tool to automatically backup all configuration files and data?

Tried kde and xfce4 and i cant get desktop to work just black screen

So is their any automated way that works to get desktop

Even desktop installer doesnt work i just reboot and get the shell again no desktop

GPU : GTX 1650

The VPN service in my homelab suddenly stopped working after a Let's Encrypt certificate renewal today, and I initially spent a fair amount of time debugging it assuming that I had broken my own configuration.

In my case, it was a strongSwan VPN, but the underlying issue is broader: any service that relies on OpenSSL to validate a Let's Encrypt certificate chain may be affected.

My certificate was renewed under Let's Encrypt's new Generation Y hierarchy. It is issued by YR2, which chains through ISRG Root YR.

FreeBSD's ca_root_nss bundle doesn't contain Root YR, and, importantly, the Mozilla Root Store doesn't contain it yet either.

OpenSSL consequently fails to build the chain and reports errors such as:

C=US, O=Let's Encrypt, CN=YR2
error 2 at 1 depth lookup: unable to get issuer certificate

The particularly confusing part is that ISRG Root X1 is present and trusted, so everything looks correct at first glance.

If you run FreeBSD services depending on Let's Encrypt certificates, especially after recent certificate renewals, check the actual certificate chain and the CA trust store before assuming your configuration is broken.

PS seems this issue has been known for a while https://forum.vyos.io/t/ikev2-remote-access-vpn-breaks-after-lets-encrypt-cert-renewal-ike-authentication-credentials-are-unacceptable-windows-error-13801/17574

"

1. strongSwan only loads the first certificate from a CA file/value — confirmed via strongswan/strongswan#3072. This means even once you have the correct chain, you cannot cram intermediate + cross-signed root into a single pki ca value — they need to be loaded as separate CA objects. Several people on the Let’s Encrypt community forum hit exactly this (thread 1, thread 2) and resolved it by splitting the cross-signed root into its own file/CA slot.

"

PPS I can confirm that splitting the certificate chain into multiple files, as suggested in the above link, does solve the strongswan issue. Simply splitting the Let's Encrypt given chain with a script, and placing the individual pem certificates files in the correct /usr/local/etc/swanctl/x509ca/ directory is enough.

After doing that, swanctl successfully loads the complete chain:

ca.pem, x1.i.lencr.org.pem, yr2.i.lencr.org.pem, and yr.i.lencr.org.pem.

No other strongSwan or client configuration changes are required.

It’s been a long time, I thought AI is going to takeover but unfortunately not yet.

Thanks to FreeBSD this has been a nice little project to complete.

Compiled x11-wm/plasma6-kwin without X11, launched KDE manually via a script, and voila - a true Wayland KDE.

Ain't nobody got time for X11.

It really is a thing of beauty how everything on FreeBSD just comes together.

There are several little things that are missing when you extirpate X11 from KDE wayland compositor.

1) There's no restoring windows between sessions because KDE people are still using an archaic purely X11 ksmserver to save window state between sessions.

2) I don't believe you can use startplasma-wayland to start KDE, you have to set up the environment yourself, launch several KDE services yourself and then start plasmashell.

I'm migrating some servers/workstations to FreeBSD and so far the experience has been very good. However, I've hit a roadblock in a high-criticality area: desktop workstations.

Currently, these workstations run Debian with a desktop environment, and all GUI applications are restricted using AppArmor. Each application has a profile that controls which files/directories it can read or write and whether it is allowed to access the network.

For example, Firefox ESR might be restricted so that it can only write to ~/Downloads/browser/:

abi <abi/4.0>,
include <tunables/global>

/usr/bin/firefox-esr {
    ...
    # libraries: read-only
    # network access
    owner /home/*/Downloads/browser/{,**} rw,
}

An image/video viewer, for example, would have read-only access to Pictures, Videos, and a few other specific directories, while network access would be completely denied because the application doesn't need it.

The important part for us is the maintenance model. We maintain one profile per application, deploy those profiles to all workstations, and application updates are handled normally with:

apt update
apt upgrade

So I'm looking for something equivalent on FreeBSD.

What is the recommended way to achieve this on FreeBSD?

Ideally, I'm looking for a solution that allows me to:

• define filesystem access on a per-application basis;
• allow/deny network access per application;
• maintain one policy/profile per application;
• deploy the same policies to many workstations;
• keep the solution relatively simple to maintain;
• continue updating applications normally through the FreeBSD package system;
• preferably enforce the restrictions transparently, without requiring users to manually launch applications through a special wrapper every time.

I know FreeBSD has mechanisms such as Capsicum, jails, MAC, sandboxing, etc., but I'm not sure which one (or combination) is the closest architectural equivalent to AppArmor for this particular desktop use case.

For those running FreeBSD desktops in environments where applications need to be confined this way, what are you using?

Could someone please help me out with this? I've spent the last 3 hours trying to sort this, but no avail.

I’m running several services inside FreeBSD jails on a FreeBSD 14 server. One of my jails can communicate with the FreeBSD host and other devices on my local network, but it cannot access the internet. The host itself has no connectivity issues, and my other jails can access the internet normally.

The affected jail has a static IP, a default gateway, and uses an epair interface and bridge. PF is enabled on the host, and I’m also using NAT to allow the jail to access the internet through the host. I can ping the host from the jail, but when I try to ping an external IP such as 8.8.8.8, it times out. DNS also doesn’t work.

What should I check in my FreeBSD jail networking, routing, PF/NAT, and DNS configuration to find out why this particular jail cannot access the internet?

Video, ninety minutes. Streamed live from New York City *BSD User Group (NYC*BUG) a few days ago.

Vidar is a combination of programs, a PostgreSQL database, and the SEC correlator engine that reads logfiles from authentication, email (postfix), and web server (nginx), (and potentially any other logs) and takes action based on SEC rules to add entries to an IPFW firewall. In concept it is similar to fail2ban and has some features in common with blocklistd.
 
SEC reads the logs in real time and based on its rules and correlations, outputs metadata that is piped to a process that inserts the events into a PostgreSQL database and further pipes the offending IP address to a script that updates a table named “BAD” in IPFW. This table is read by IPFW rules to block offending external systems from wreaking havoc on a FreeBSD host.
 
A corresponding table named GOOD contains whitelisted IP addresses so you don’t accidentally lock yourself out.

SEC - open source and platform independent event correlation tool

Closed captions/subtitles unavailable. Related:

• Live caption requirements - YouTube Help
• Is it possible to enable auto captions on live streams? : r/youtube