NetBSD 的 jails – 内核强制隔离与原生资源控制
Jails for NetBSD – Kernel Enforced Isolation and Native Resource Control

原始链接: https://netbsd-jails.petermann-digital.de/

本文详细介绍了一种使用 `jailmgr` 和 `jailctl` 在 NetBSD 中创建和管理轻量级 jails 的简化流程。过程从准备主机系统、加载必要的内核模块以及设置 jail 目录结构开始。在此示例中,jail 被命名为“web”,并配置为在 8080 端口上运行 HTTP 服务器,并指定了加固配置文件。 主要特性包括*临时配置*——允许在不进行持久更改的情况下在 jail *内部* 执行临时命令——以及一个*监管模型*,其中 `jailctl` 管理 jail 内部的进程,从而从主机获得完全可见性。运行时统计信息,包括 CPU 使用率、内存和进程数量,可以通过 `jailctl stats` 访问,并可以使用像 `inetd` 这样的基本系统工具导出为 Prometheus 兼容格式。 这种方法提供了进程隔离,而无需容器运行时、UID 重新映射或完全虚拟化的开销,为安全的服务部署提供了一种规范且可检查的系统原语。

Hacker News 新闻 | 过去 | 评论 | 提问 | 展示 | 招聘 | 提交 登录 NetBSD 监狱 – 内核强制隔离和原生资源控制 (petermann-digital.de) 10 分,由 vermaden 2小时前发布 | 隐藏 | 过去 | 收藏 | 2 条评论 帮助 ggm 1小时前 [–] 我将发表与之前帖子相同的评论。要么记录它与FreeBSD监狱的不同之处,要么给它起一个不同的名字。否则只会引起混淆。回复 LargoLasskhyfv 1小时前 | 父评论 [–] FAQ 的第三条是否足够了?回复 指南 | 常见问题 | 列表 | API | 安全 | 法律 | 申请 YC | 联系 搜索:
相关文章

原文

This section demonstrates a minimal, reproducible workflow using jailmgr, jailctl, and NetBSD base components.

The example provisions a constrained HTTP service inside a jail, starts it, inspects runtime state, and exposes metrics.


1. Bootstrap

Prepare the host for jail operation.

This step:

  • Loads the secmodel_jail kernel module
  • Ensures it is configured for automatic loading on boot
  • Prepares base filesystem layers
  • Creates default configuration files
  • Initializes the jail data directory layout

2. Create Jail

Create a jail named web with:

  • HTTP daemon bound to port 8080
  • Medium hardening profile
  • Reserved listening port 8080
  • Structured logging
vhost# jailmgr create -a -x '/usr/libexec/httpd -I 8080 -X -f -s /var/www/mysite' -l medium -r 8080 -f local3 -o info -e err -t jail-web web
Created jail web
vhost#

3. Ephemeral Provisioning

Execute commands inside the jail from the host, without altering its persistent configuration.

The jail is entered temporarily, the commands are run, and control returns to the host.

vhost# jailmgr apply --ephemeral web <<'APPLY'
mkdir -p /var/www/mysite
echo "<html>Hello NetBSD!</html>" > /var/www/mysite/index.html
APPLY

4. Start All Jails

Each jail configuration contains an autostart setting that can be enabled or disabled individually. The --all option operates only on jails where autostart is active.

vhost# jailmgr start --all
Started jail web
vhost#

5. Supervision Model

When started in supervise mode, jailctl daemonizes itself on the host and becomes the parent process for the workload running inside the jail.

All processes started within the jail are descendants of the jailctl supervise process.

From the host perspective, these processes remain fully visible in the standard process table. There is no hidden runtime or separate process namespace.

Host process tree:

vhost# ps axd
....
8252 ?     Ss   0:00.00 |-- jailctl: jailctl supervise jail=web jid=3 
6488 ?     Ss   0:00.01 | `-- /usr/libexec/httpd -I 8080 -X -f -s /var/www/mysite 

Enter jail context:

vhost# jailctl exec web
vhost# whoami
root
vhost# ps axd
 PID TTY   STAT    TIME COMMAND
6488 ?     Is   0:00.01 /usr/libexec/httpd -I 8080 -X -f -s /var/www/mysite 
7117 pts/1 S    0:00.01 /bin/sh -i 
5572 pts/1 O+   0:00.00 - ps -axd 
vhost#

Inside the jail context, even the root user can only see processes belonging to that jail.

Cross-jail process visibility is denied by the kernel. The host context (jid 0) remains the only global view.


6. Runtime Statistics

Snapshot telemetry per jail is maintained inside the kernel and exposed through the control interface.

vhost# jailctl stats
ID       NAME             CPU1S      CPU10S     PROC       REFS       VMEM
3        web              0          0.0        1          2          154025984

7. Prometheus-Compatible Metrics Endpoint

jailctl stats can emit Prometheus-compatible metrics.

The -P flag switches to Prometheus exposition format.
The -h flag prepends a minimal HTTP header.

This makes it possible to expose the metrics endpoint using only base system facilities (for example via inetd), without requiring a dedicated exporter daemon.

vhost# jailctl stats -P -h
HTTP/1.1 200 OK
Content-Type: text/plain

# TYPE jail_cpu_usage_ticks_1s gauge
# TYPE jail_cpu_usage_ticks_10s_avg gauge
# TYPE jail_processes gauge
# TYPE jail_references gauge
# TYPE jail_vmem_bytes gauge
jail_cpu_usage_ticks_1s{jid="3",name="web",root="/var/jailmgr/jails/web/root"} 0
jail_cpu_usage_ticks_10s_avg{jid="3",name="web",root="/var/jailmgr/jails/web/root"} 0
jail_processes{jid="3",name="web",root="/var/jailmgr/jails/web/root"} 1
jail_references{jid="3",name="web",root="/var/jailmgr/jails/web/root"} 2
jail_vmem_bytes{jid="3",name="web",root="/var/jailmgr/jails/web/root"} 154025984

Result

  • Base-system HTTP daemon
  • Snapshot-based observability
  • Supervised execution
  • Ephemeral provisioning
  • Observable via structured metrics
  • No container runtime
  • No UID remapping
  • No full virtualization

This is process isolation as a disciplined, inspectable system primitive.

联系我们 contact @ memedata.com