FreeBSD Articles

The third in the FreeBSD Foundationals series. This one covers how FreeBSD actually boots: the stages from power-on to login, BIOS vs UEFI, the loader and loader.conf, the difference between read-only tunables and runtime sysctls, the modern way to load kernel modules with kld_list, managing it all safely with sysrc, a practical security-hardening baseline, and - the headline act - boot environments with bectl, the undo button that turns a broken upgrade into a thirty-second reboot.

How I watch burningboard.net, my multi-jail FreeBSD Mastodon instance, from a separate observer host. A pull-based Prometheus stack reaching exporters across my own AS201379 backbone (locked down at the perimeter firewall, not by binding to unroutable addresses), Loki and Promtail for nginx logs, a textfile collector that fills the gaps FreeBSD exporters leave (ZFS, S3, pkg audit, Mastodon API stats), one Grafana dashboard that tells me at a glance whether the instance is healthy, and an Alertmanager ruleset that emails me before users notice.

FreeBSD 15 ships mdo(1) and the mac_do(4) policy module in the base system. It replaces sudo and doas for most of my hosts, needs no ports, and configures with a single sysctl. This article walks through enabling it, the rule syntax, a few real examples, and a short detour into the security sysctls I run on every box.

A practical tour of FreeBSD’s built-in tools for watching CPU, memory, disk I/O, and network activity, finding the process or jail that is eating your server, and applying per-jail accounting and limits with kern.racct and rctl.

cdist is refreshingly minimal - the target only needs POSIX sh, and the control machine speaks ssh. But cdist expects one ssh endpoint per host, and FreeBSD jails are not normally their own ssh targets. Two small Python wrappers plug cdist into jexec on the host, so configuration state flows into every jail without running a single daemon, agent, or Python interpreter inside the jail itself.

Podman runs on FreeBSD too - but without systemd, the workflow is different. This follow-up to my Linux Podman deep dive covers how to run both native FreeBSD and Linux OCI containers on FreeBSD, how container lifecycle management works without Quadlets, and how Podman complements Jails rather than replacing them.

How to run a FreeBSD server with two completely independent internet uplinks - a physical provider and a BGP tunnel - using dual-FIB routing tables, PF’s rtable and reply-to directives, and a single bridge that carries NAT’d, routed, and pure public jail traffic simultaneously.

The second in the FreeBSD Foundationals series. This one covers ZFS from philosophy to practice: why it exists, how pools and datasets work, what checksumming and self-healing actually do, how to tune recordsize, compression, and atime, how encryption works with key management, how snapshots and the hidden .zfs directory give you time travel, and how ZFS send/recv turns backup and migration into a solved problem. Includes a look at sanoid/syncoid for automated snapshot management.

The first in a series on FreeBSD fundamentals. This one covers Jails from the ground up: why they exist, how classic Jails differ from VNET Jails, what epair interfaces actually are, how bridges tie it all together, and what devfs rules do for your isolation story. Practical configurations included.

What looked like a simple nginx config change turned into a tour through SSL library incompatibilities, pf firewall rules for a new protocol, and a multi-worker affinity problem that only shows up under real traffic. A complete guide to getting HTTP/3 working with nginx 1.28 on FreeBSD 15.0 inside a Bastille jail.