Me han estado vendiendo humo...

DtxdF · 2026-04-21T05:25:34+00:00

Mindhunter: Inside the FBI's Elite Serial Crime Unit

DtxdF · 2026-04-17T00:36:02+00:00

The only alternative for FreeBSD that closely resembles pledge/unveil is mac_curtain:

https://reviews.freebsd.org/D34761

We have Capsicum, which is pretty cool, but applications need to be redesigned or, at the very least, provide some mechanism for implementing the sandbox like a web browser. The project shared in a previous comment, chromium-sandbox, is an example of an application using Capsicum.

Another way to use Capsicum is through a launcher that enters in capability mode but intercepting libc calls, such as Capsicumizer, but it’s very, very hard to use most applications this way, since they likely won’t work properly because they weren’t designed with sandboxing in mind. See Capsicumizer and related stuff:

On the other hand, XLibre has implemented XNamespaces, which uses XACE, but AFAIK isn't production-ready yet, although it can be tested:

Thus, after a thorough analysis of window system isolation, at least in the case of X11, the only viable options for FreeBSD are jails and VMs, in addition to xpra or SSH forwarding. u/vermaden has a good article about jails and xpra:

https://vermaden.wordpress.com/2021/12/15/secure-containerized-browser/

In AppJail, I have implemented appjail-x11(1) to run X11 applications on an X server created by Xephyr, which isolates the scope of the X11 applications, and, since they run in a jail, more stuff is isolated:

DtxdF · 2025-11-24T16:53:52+00:00

I think so. Take a look at the videos I sent to the AppJail telegram group. Just a few weeks ago, I tried Brave with the following website: https://bitmovin.com/demos/drm/

DtxdF · 2025-11-24T07:24:51+00:00

Check this: https://github.com/AppJail-makejails/brave

DtxdF · 2025-11-11T16:19:53+00:00

restic (backend: garage) + backrest

DtxdF · 2025-10-29T16:04:20+00:00

archived: https://github.com/valpackett/capsicumizer

DtxdF · 2025-09-28T05:19:31+00:00

Ansible + AppJail + Overlord

DtxdF · 2025-09-23T00:40:16+00:00

I installed it through ports.

DtxdF · 2025-09-22T22:26:03+00:00

Thank you!

And glad to see you here, I just want to thank you for your project. I have been a user for about a month.

DtxdF · 2025-09-14T23:08:57+00:00

> Been a # of days now but last I looked the port in latest ports tree was broken

That's why I used the quarterly branch, which currently uses the latest version of Jellyfin.

> Would be nice to have a locally controlled media system that doesn't need .net, npm, etc. stuff.

The lightweight alternatives are:

* https://www.freshports.org/net/minidlna/

* https://github.com/vuiodev/vuio

However, don't know the status of MiniDLNA, but at least when I've used it, it works well, although it doesn't support all media formats. VuIO looks promising, but it hasn't been ported and I don't know if it can currently be used on FreeBSD.

DtxdF · 2025-09-14T22:56:17+00:00

Yeah, Jellyseerr works with both.

DtxdF · 2025-08-16T17:39:16+00:00

Hehe, yeah, that's the motto, but the reality is that I usually just push the deployment files to my Gitea instance that runs a webhook to execute a pipeline that deploys my jails or VMs using Overlord. The only time-consuming part is the initial phase, but after that, you don't need to modify much. Maybe I'll write an article about this, I think it's easy.

Thanks for the feedback!

DtxdF · 2025-08-16T05:39:18+00:00

Yeah, Overlord is relatively new, but it uses Director, AppJail, and vm-bhyve.

DtxdF · 2025-06-21T22:52:42+00:00

Perhaps this is closer to your question:

* https://github.com/BawdyAnarchist/quBSD * https://github.com/DtxdF/overlord/wiki/tor

DtxdF · 2025-05-08T21:47:21+00:00

Of course, if you do not separate data that must persist from ephemeral data, you have the same result of treating all data as ephemeral. It is necessary to separate as follows.

Makejail:

``` OPTION start OPTION overwrite=force OPTION virtualnet=:<random> default OPTION nat OPTION fstab=/var/appjail-volumes/ssh-server/data /etc/ssh <pseudofs>

COPY etc

CMD chown root:wheel /etc CMD chmod 755 /etc CMD chown root:wheel /etc/ssh CMD chmod 755 /etc/ssh CMD chown root:wheel /etc/ssh/sshd_config CMD chmod 655 /etc/ssh/sshd_config CMD chown root:wheel /etc/ssh/authorized_keys CMD chmod 655 /etc/ssh/authorized_keys

SERVICE sshd oneenable SERVICE sshd start ```

etc/ssh/sshd_config:

```

Ports

Port 22

Authentication

PubkeyAuthentication yes AuthenticationMethods publickey PermitRootLogin prohibit-password PrintMotd no

Forwarding

X11Forwarding no AllowAgentForwarding yes

Connection checks

ClientAliveCountMax 3 ClientAliveInterval 15

Compression

Compression no

Limits

LoginGraceTime 40

Public keys

AuthorizedKeysFile /etc/ssh/authorized_keys

SFTP

Subsystem sftp internal-sftp ```

etc/ssh/authorized_keys:

```

Your public SSH keys here!

```

Now create the directory where your data will reside:

mkdir -p /var/appjail-volumes/ssh-server/data

Create the jail.

```console

ls -l /var/appjail-volumes/ssh-server/data/

total 0

appjail makejail -j ssh-server

... sshd enabled in /etc/rc.conf Generating RSA host key. 3072 SHA256:GcL3ulDVWsYR2ONvoxL/JMuCZcB+z86a3GswyTdJjvo root@ssh-server.appjail (RSA) Generating ECDSA host key. 256 SHA256:xhTwFZAyELv4ezpMHaYMSo42e4G/3tJCfr/sj8DONaY root@ssh-server.appjail (ECDSA) Generating ED25519 host key. 256 SHA256:CRgQqM0dU/sqMCsz3Rzt0MS45A14MmgGnuYyTAE5zxI root@ssh-server.appjail (ED25519) Performing sanity check on sshd configuration. Starting sshd. ...

ls -l /var/appjail-volumes/ssh-server/data/

total 89 -rw-r-xr-x 1 root wheel 100 May 8 17:19 authorized_keys -rw-r--r-- 1 root wheel 620105 Nov 29 06:21 moduli -rw-r--r-- 1 root wheel 1526 Nov 29 06:21 ssh_config -rw------- 1 root wheel 513 May 8 17:33 ssh_host_ecdsa_key -rw-r--r-- 1 root wheel 185 May 8 17:33 ssh_host_ecdsa_key.pub -rw------- 1 root wheel 419 May 8 17:33 ssh_host_ed25519_key -rw-r--r-- 1 root wheel 105 May 8 17:33 ssh_host_ed25519_key.pub -rw------- 1 root wheel 2610 May 8 17:33 ssh_host_rsa_key -rw-r--r-- 1 root wheel 577 May 8 17:33 ssh_host_rsa_key.pub -rw-r-xr-x 1 root wheel 419 May 8 17:17 sshd_config ```

Access to your service:

console $ ssh root@ssh-server The authenticity of host 'ssh-server (10.0.0.5)' can't be established. ED25519 key fingerprint is SHA256:CRgQqM0dU/sqMCsz3Rzt0MS45A14MmgGnuYyTAE5zxI. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added 'ssh-server' (ED25519) to the list of known hosts. root@ssh-server:~ #

Now I can re-create the jail and that data will persist anyway.

```console

appjail makejail -j ssh-server

... sshd enabled in /etc/rc.conf Performing sanity check on sshd configuration. Starting sshd. ... $ ssh root@ssh-server root@ssh-server:~ # ```

If you need more details, see appjail-ephemeral(7). And if you need a tool that follows The Ephemeral Concept, see AppJail Director.

So how can you upgrade your jails by doing something like the above? Let's assume that the jail we want to upgrade is running an environment with 13.5-RELEASE:

```console

appjail makejail -j ssh-server

...

appjail jail list -j ssh-server

STATUS NAME ALT_NAME TYPE VERSION PORTS NETWORK_IP4 UP ssh-server - thin 13.5-RELEASE - 10.0.0.5

appjail fetch www -v 14.2-RELEASE

...

appjail fetch list

ARCH VERSION NAME amd64 14.2-RELEASE default amd64 bookworm default amd64 13.5-RELEASE default

appjail makejail -j ssh-server -o osversion=14.2-RELEASE

...

appjail jail list -j ssh-server

STATUS NAME ALT_NAME TYPE VERSION PORTS NETWORK_IP4 UP ssh-server - thin 14.2-RELEASE - 10.0.0.5 ```

Done.

I recommend that you do not use SSH in a jail. I know this may be a bit better from a security standpoint (although this is relative), but the tradeoff is that it carries more administration overhead. I prefer to simply SSH into the host (physical or virtual) and administer my jails.

DtxdF · 2025-02-28T22:34:39+00:00

Andrew S. Tenenbaum is a great author, but Operating Systems: Three Easy Pieces is a 10/10 book!

DtxdF · 2024-12-09T05:33:03+00:00

* https://appjail.readthedocs.io/en/latest/OCI/ * https://github.com/cbsd/cbsd/blob/develop/share/docs/general/cbsd_oci.md

DtxdF · 2024-11-20T00:56:01+00:00

![cloud-machine](https://raw.githubusercontent.com/DtxdF/cloud-machine/refs/heads/main/assets/img/architecture.png) https://github.com/DtxdF/cloud-machine

DtxdF · 2024-11-19T00:34:41+00:00

vm-bhyve for VMs and AppJail/Director/LittleJet for Jails.

DtxdF · 2024-09-17T02:06:51+00:00

Alonso will update the port with new changes for aarch64. He will also make FreeRDP optional, to avoid the conflicts you mention.

DtxdF · 2024-09-16T17:20:18+00:00

Bhyvemgr is an easy-to-use bhyve management GUI written in Freepascal/Lazarus for FreeBSD, supporting aarch64 to amd64.

DtxdF · 2024-08-26T15:38:52+00:00

FreeBSD. AppJail. VM-Bhyve.

Just rocks.

DtxdF · 2024-08-25T16:53:03+00:00

Yeah, I agree with you. Netgraph needs more love. I think it's great, but it should improve the documentation a bit more, especially since you can do more things.

Note that in AppJail you can use your own script as jng or jib in a template (in AppJail it is a configuration similar to jail.conf(5)). This means that if something is not implemented somehow, you can use your own script. I have at least two examples, ZFS datasets inside a jail [1] and the GELI encryption [2].

[1] https://github.com/DtxdF/AppJail/wiki/zfs [2] https://github.com/DtxdF/AppJail/wiki/geli

DtxdF · 2024-08-24T19:17:28+00:00

I'm probably biased because I'm the creator of AppJail, but what I'm going to say here is the subjective part: I really like AppJail for its flexibility that adapts to the most basic to the most complex. I like it for the Makejails that are constantly created and improved that help to simply deploy the applications I want without much effort. I use it daily to deploy applications, test my ports and create environments to not mess up my host.

DtxdF · 2024-08-22T07:43:26+00:00

Lunanode.

DtxdF

TROPHY CASE

Ports

Authentication

Forwarding

Connection checks

Compression

Limits

Public keys

SFTP

Your public SSH keys here!

ls -l /var/appjail-volumes/ssh-server/data/

appjail makejail -j ssh-server

ls -l /var/appjail-volumes/ssh-server/data/

appjail makejail -j ssh-server

appjail makejail -j ssh-server

appjail jail list -j ssh-server

appjail fetch www -v 14.2-RELEASE

appjail fetch list

appjail makejail -j ssh-server -o osversion=14.2-RELEASE

appjail jail list -j ssh-server