FreeBSD Jails and ZFS

In FreeBSD, both Jails and ZFS, have a long history. In this short post I will show how to
use ZFS and Jails by creating a base jail on ZFS to use that Jail as the base jail for all other jails
you need on your system.

Since system administration is a difficult task, many tools have been developed to make life
easier for the administrator. These tools often enhance the way systems are installed, configured,
and maintained. One of the tools which can be used to enhance the security of a FreeBSD system
is jails. Jails have been available since FreeBSD 4.X and continue to be enhanced in their
usefulness, performance, reliability, and security.

is significantly different from any previous file system because it is more than just a file system.

So, using both technologies together is a logical step forward as a systemadministrator to

simplify and structure your the daily business.

Create a new ZFS dataset

zfs create -o compress=lz4 zroot/jails/base101x64

Change directory to /var/tmp and fetch the dist files

fetch ftp://ftp.freebsd.org/pub/FreeBSD/releases/amd64/10.1-RELEASE/base.txz
fetch ftp://ftp.freebsd.org/pub/FreeBSD/releases/amd64/10.1-RELEASE/src.txz fetch
ftp://ftp.freebsd.org/pub/FreeBSD/releases/amd64/10.1-RELEASE/lib32.txz fetch
ftp://ftp.freebsd.org/pub/FreeBSD/releases/amd64/10.1-RELEASE/games.txz

Untar distfiles to ZFS dataset

 tar -JxvC /jails/base101x64/ -f base.txz

 tar -JxvC /jails/base101x64/ -f src.txz
 tar -JxvC /jails/base101x64/ -f lib32.txz
 tar -JxvC /jails/base101x64/ -f games.txz
Update Jail to actual patchlevel

freebsd-update -b /jails/base101x64 fetch install

Configuration of jail
cp /etc/resolv.conf /jails/base101x64/etc/

vi /jails/base101×64/etc/rc.conf

 rpcbind_enable="NO"
 font8x8="iso15-8x8"
 font8x14="iso15-8x14"
 font8x16="iso15-8x16"
 keymap="german.iso"
 sendmail_enable="NONE"
 clear_tmp_enable="YES"
 syslogd_flags="-ss"
 sshd_enable="YES"
Chroot and config jail

chroot /jails/base101x64

#newaliases #passwd root #pkg #exit

Take a snapshot if the new Jail

zfs snapshot zroot/jails/base101x64@p6

Next we can use clones for a new jail but keep in mind, clones are based on the
snapshot, so you can not delete the snapshot before deleting the clone. So I prefer to
create a copy of the snapshot as the new jail. So, skip the next step if you do not want
to use clones.

zfs clone zroot/jails/bas101x64@p6 zroot/jails/j_new

Copy the snapshot

zfs send -v zroot/jails/base101x64@p6| zfs receive zroot/jails/j_new

The best thing is, you can also use zfs send and receive to copy a ZFS dataset, jail, from
one host to another. And, the ZFS pool will also be created for you, you do not have to
do anything, just copy, magic.
As you can figure out, also backup a ZFS dataset (jail) is very simple. Just take a snapshot and
make the backup from the snapshot and keep the jail running.