#jails Articles

cdist is refreshingly minimal - the target only needs POSIX sh, and the control machine speaks ssh. But cdist expects one ssh endpoint per host, and FreeBSD jails are not normally their own ssh targets. Two small Python wrappers plug cdist into jexec on the host, so configuration state flows into every jail without running a single daemon, agent, or Python interpreter inside the jail itself.

Podman runs on FreeBSD too - but without systemd, the workflow is different. This follow-up to my Linux Podman deep dive covers how to run both native FreeBSD and Linux OCI containers on FreeBSD, how container lifecycle management works without Quadlets, and how Podman complements Jails rather than replacing them.

How to run a FreeBSD server with two completely independent internet uplinks - a physical provider and a BGP tunnel - using dual-FIB routing tables, PF’s rtable and reply-to directives, and a single bridge that carries NAT’d, routed, and pure public jail traffic simultaneously.

The first in a series on FreeBSD fundamentals. This one covers Jails from the ground up: why they exist, how classic Jails differ from VNET Jails, what epair interfaces actually are, how bridges tie it all together, and what devfs rules do for your isolation story. Practical configurations included.

What looked like a simple nginx config change turned into a tour through SSL library incompatibilities, pf firewall rules for a new protocol, and a multi-worker affinity problem that only shows up under real traffic. A complete guide to getting HTTP/3 working with nginx 1.28 on FreeBSD 15.0 inside a Bastille jail.

Using a JeeLink USB stick inside a FreeBSD jail to bridge legacy LaCrosse temperature and humidity sensors to Home Assistant over MQTT

Running CryptPad in a FreeBSD VNET jail with isolated networking, NAT via PF, and Caddy for TLS termination.

A technical deep-dive into running a modern, secure mail server on FreeBSD 15.0 using VNET jails, ZFS encryption, and GeoIP-aware firewalling.

A custom Ansible connection plugin that enables native management of FreeBSD jails via jexec, without requiring SSH inside each jail.

How to run a Factorio dedicated server inside a FreeBSD jail using Linux binary compatibility, with no native port required.