FreeBSD Articles

A FreeBSD 15.1 Plasma desktop in a Proxmox VM, reachable over xrdp, running Claude Code as a Linux binary through the Linuxulator. Along the way: an Xorg that found no screens, a KRDP package that does not exist, a VirtIO-GPU that gives you a framebuffer but no acceleration, and a “version regression” that turned out to be two Claude installations fighting over my PATH. Then I let the agent firewall the machine it was running on, and it did that more carefully than I usually do. It also got one thing wrong, and of course it was the thing about root.

The fourth in the FreeBSD Foundationals series. This one picks up where the boot article stopped, at the moment init runs /etc/rc. It covers how rc finds and orders scripts with rcorder, how rc.conf and its layers are really just shell, what rc.subr gives you for free, how to drive it all with service and sysrc (including inside jails), how to write a correct rc.d script for your own daemon using daemon(8) supervision, and the pidfile trap that makes “service stop” restart your process instead of stopping it. Then an honest audit of the rc.d scripts running my own Mastodon, Zigbee2MQTT and NetBox jails. Plus service jails, debugging, and an honest comparison with systemd units.

For almost a year, my jailexec connection plugin let a compromised FreeBSD jail redirect a root-owned write onto the jail host. The input validation was fine. The problem was on which side of the jail boundary the paths were resolved. This is the story of the bug, the fix in 2.0.0, and the CVE that came with it.

A jail shares the host kernel, so sooner or later you need a real virtual machine. bhyve has been able to run inside a jail since FreeBSD 12.0, and almost nobody does it. This is the full build from my production hypervisor: the devfs ruleset, the four things that have to line up, the two-tier bridge topology, and an honest account of what allow.vmm does and does not buy you.

A bug report against my jailexec connection plugin needed a real FreeBSD jail to reproduce. An idle free-tier VPS with 512 MB of RAM turned out to be plenty: pkgbase provides a 33 MB base userland, persistent jails need no idle processes, and three Python-equipped test targets added only 1.1 GB of disk use. This is the build, including the two sharp edges that cost me twenty minutes.

Being ill for a week taught me that a large Jellyfin library is not entertainment, it is homework. ErsatzTV turns a media library back into linear television with real channels and schedules, but it only ships for Linux, Windows, and macOS. It is a .NET application driving ffmpeg, so I built it in a FreeBSD Bastille jail instead. One missing conditional was all that stood between FreeBSD and Intel VAAPI hardware acceleration.

My Home Assistant OS installation runs as a bhyve VM on a FreeBSD home server, while Zigbee2MQTT and Mosquitto live in a VNET jail with direct access to a ConBee II USB adapter. Homematic comes through a CCU3, and three recent IKEA Matter-over-Thread devices use the Nanoleaf Shapes controller I already owned as their border router.

A small, database-free DokuWiki deployment in a FreeBSD 15.1 Bastille jail, with nginx and PHP-FPM inside the jail and Caddy handling TLS and access policy at the edge.

Patching FreeBSD machines inside the DN42 overlay network without giving them clearnet access - a dual-homed VM that lazily caches pkg.freebsd.org, update.freebsd.org, and release tarballs from ftp.freebsd.org with nginx proxy_store, follows CDN redirects server-side, and serves everything over IPv6 into the mesh. Now also available as a public DN42 service at bsdmirror.chofstede.dn42.

FreeBSD 15.1-RELEASE is here, and the official upgrade instructions depend on whether your system uses distribution sets or packaged base. This guide walks through both supported paths, covers the boot-loader update, and explains the configuration merging process - all based on the official 15.1 upgrading documentation.