FreeBSD Articles

Three small Rust tools from the OpenPGP Card project replace the GnuPG stack for my everyday hardware key work: oct to manage OpenPGP cards and Nitrokeys, oct-git to sign Git commits, and openpgp-card-ssh-agent as a hardware-backed SSH agent. I ported all three to FreeBSD and they are now in the ports tree. This article explains what each tool does, how they share PIN handling, and how I set them up on Fedora and on my FreeBSD T480.

The php2shell fix landed in the FreeBSD ports tree within a day, but packages had only been built for some CPU architectures, and my arm64 jail host was not among them. Instead of setting up Poudriere for a one-off job, I built the fixed PHP 8.5.12 in a throwaway Bastille jail, turned the result into a tiny local pkg repository and upgraded the affected jails from it.

My ThinkPad T480 now runs FreeBSD 15.1 as a complete desktop: Xfce 4.20, 5 GHz Wi-Fi, verified VA-API video decoding in Firefox and Chromium, Bluetooth audio, a webcam that handles Zoom calls in Firefox, a smart-card-backed SSH and Git workflow, and coding agents. Here are the packages, configuration, tests and machine-specific traps behind a laptop I can simply use.

I write Ansible for a living, and I still patched most of my own servers by hand every week. This is how that ended: a Git-based inventory, defensive patch playbooks for FreeBSD (freebsd-update and pkgbase), Bastille thin jails, classic thick jails via my jailexec connection plugin, a Proxmox cluster and RHEL. Ansible Automation Platform runs it for me, but nothing here requires it. Plus the mistakes, including the reboot policy I should have checked before the first real run.

A FreeBSD 15.1 Plasma desktop in a Proxmox VM, reachable over xrdp, running Claude Code as a Linux binary through the Linuxulator. Along the way: an Xorg that found no screens, a KRDP package that does not exist, a VirtIO-GPU that gives you a framebuffer but no acceleration, and a “version regression” that turned out to be two Claude installations fighting over my PATH. Then I let the agent firewall the machine it was running on, and it did that more carefully than I usually do. It also got one thing wrong, and of course it was the thing about root.

The fourth in the FreeBSD Foundationals series. This one picks up where the boot article stopped, at the moment init runs /etc/rc. It covers how rc finds and orders scripts with rcorder, how rc.conf and its layers are really just shell, what rc.subr gives you for free, how to drive it all with service and sysrc (including inside jails), how to write a correct rc.d script for your own daemon using daemon(8) supervision, and the pidfile trap that makes “service stop” restart your process instead of stopping it. Then an honest audit of the rc.d scripts running my own Mastodon, Zigbee2MQTT and NetBox jails. Plus service jails, debugging, and an honest comparison with systemd units.

For almost a year, my jailexec connection plugin let a compromised FreeBSD jail redirect a root-owned write onto the jail host. The input validation was fine. The problem was on which side of the jail boundary the paths were resolved. This is the story of the bug, the fix in 2.0.0, and the CVE that came with it.

A jail shares the host kernel, so sooner or later you need a real virtual machine. bhyve has been able to run inside a jail since FreeBSD 12.0, and almost nobody does it. This is the full build from my production hypervisor: the devfs ruleset, the four things that have to line up, the two-tier bridge topology, and an honest account of what allow.vmm does and does not buy you.

A bug report against my jailexec connection plugin needed a real FreeBSD jail to reproduce. An idle free-tier VPS with 512 MB of RAM turned out to be plenty: pkgbase provides a 33 MB base userland, persistent jails need no idle processes, and three Python-equipped test targets added only 1.1 GB of disk use. This is the build, including the two sharp edges that cost me twenty minutes.

Being ill for a week taught me that a large Jellyfin library is not entertainment, it is homework. ErsatzTV turns a media library back into linear television with real channels and schedules, but it only ships for Linux, Windows, and macOS. It is a .NET application driving ffmpeg, so I built it in a FreeBSD Bastille jail instead. One missing conditional was all that stood between FreeBSD and Intel VAAPI hardware acceleration.