FreeBSD jails: an administrative overview of jail.conf, jls, jexec and resource limits with rctl

What it is

FreeBSD jails have been available since FreeBSD 4.X and build on the chroot(2) concept of changing the root directory for a set of processes. The Handbook describes the result as creating "a safe environment, separate from the rest of the system," where processes inside cannot access files or resources outside it — but a jail goes further than a plain chroot by also confining process visibility, and optionally networking, from the rest of the system, which a bare chroot does not do.

A jail is declared in /etc/jail.conf as a named block of parameter assignments, for example:

foo {
    host.hostname = "foo.com";
    ip4.addr = 10.1.1.1, 10.1.1.2, 10.1.1.3;
    path = "/var/jail/$name";
    exec.start = "/bin/sh /etc/rc";
    exec.stop = "/bin/sh /etc/rc.shutdown jail";
    mount.devfs;
}

jail.conf(5) documents path, host.hostname, ip4.addr/ip6.addr, and exec.start/exec.stop as the parameters that set the jail's root, hostname, addresses, and startup/shutdown commands respectively; mount.devfs gives the jail a restricted /dev; $name and ${host.hostname} are examples of the variable substitution the format supports.

Why it matters

Because a jail is administered from the host rather than logged into like a separate machine for routine management, the host-side tools matter as much as the jail's own configuration. jls(8) lists all active jails (or one, given a JID or name) with their addresses and paths — the quickest way to confirm what is actually running. jexec(8) executes a command inside an existing jail from the host, the normal way to get an interactive shell for troubleshooting without exposing a jail-internal SSH daemon. Resource limits are set with rctl(8), independent of the jail's own configuration; the Handbook's examples cap CPU, process count, open files and memory per jail, for example rctl -a jail:classic:pcpu:deny=80. rctl works only with the kern.racct.enable=1 tunable in /boot/loader.conf (a boot-time setting), and rules added with rctl -a are lost at reboot unless also written to /etc/rctl.conf.

How to apply

• Start with jail.conf, not repeated jail(8) command-line invocations, so the configuration is reviewable and reproducible; sysrc jail_enable=YES starts the configured jails at boot, and service jail start <name> starts one now.
• Use jls before and after any host reboot or jail restart to confirm the expected set of jails is running with the expected addresses.
• Enter a jail for maintenance with jexec <jail> <command> rather than running services with network-exposed shell access inside it.
• Cap resource-hungry jails with rctl rules per jail name (jail:<name>:<resource>:deny=<amount>), so one jail cannot starve the host or its siblings.

Pitfalls

• Treating a jail as a full security boundary equivalent to a virtual machine: without rctl limits, one jail can still exhaust host-wide resources such as memory or file descriptors.
• Forgetting that exec.start/exec.stop run the jail's own rc scripts — a jail's rc.conf inside path needs its services enabled the same way a full host would, or nothing starts when the jail does.