karolyi: hi, what did I break? :-) /me scrolls back

oh, this github issue is tickling something, hold on

right on

karolyi: can you tell me a little bit more about how DNS is configured on this system?

kevans: what details are you curious of? I'm open like a book :)

mostly: is it running a local resolver, or is the resolver external to the system?

a resolver external to the jail

external to the jail, but is it on the same system?

right now it's 'nameserver 127.0.0.74\noptions edns0 trust-ad'

yes it is

a-ha

chroot is a red herring, you're getting bitten by cgit.freebsd.org/src/commit/lib/lib…d67a952e999c39ee21a5e50122b13a6d391

there's a longer story behind things being forbidden from connecting to 0.0.0.0

how often are failing pkgs (fallout) rebuilt?

the cluster does a `poudriere bulk -a` in an infinite loop, more or less, so the answer depends on how long the rest of the run takes to get through

kevans: um, the jail has 127.0.0.74 on lo0 so that's its loopback address

and is there a way to know which pkgs are provided as binaries?

instead of just the port

karolyi: yes, but libc/resolv is specifically using INADDR_LOOPBACK (127.0.0.1) to connect

Xinayder: generally the answer comes from its license terms; the cluster doesn't make any special determination here, beyond whether the license terms allow packaging or not

(freshports can tell you if there are any packages for a given port anywhere, though)

freshports++

kevans: so unless I explicitly specify that in a chroot-relative etc/resolv.conf, it won't talk to 127.0.0.74... makes a bit more sense, but I would never had guessed that INADDR_ANY can be 127.0.0.74

kevans, there's a table on the freshports page for a port, I didn't notice it before. I see now

karolyi: that's the problem with the previous state, INADDR_ANY was something like 'the first address configured' by some metric

it's a crap-shoot

well that crapshoot worked for my case :)

the jail starts up with that IP, it's is changing on redeployment (by an ansible script), but since INADDR_ANY found it, it was not an issue

some additional context for the overall problem with it: bugs.freebsd.org/bugzilla/show_bug.cgi?id=280705

I'll just reconfigure php to not be in chrooted mode then

ah yeah I've heard about that bug, it's how meta also evaded android sandboxing

and managed to track users across applications

i take the fact that paul vixie advocated for breaking connections to it after probably taking advantage of it in earlier days as probably a sign of some sort

welp

just read through the bug page, if it's better off this way, I can make my changes. just wanted to get to the bottom of it

yeah, sorry to be the bearer of bad news

at least we found out :) thanks no matter what

good morning. I have a technical question that I think might be faster and more comprehensively answered here than via searching the web or reading the handbook.

The question is this: What is the _technical_ difference between the Linux Container technology stack (namespaces, chroot, syscall filter, capabilities, bpf, etc.) and FreeBSD jails ?

because at a glance from reading over the handbook it seems like Jails are basically equivalent to linux namespaces

that is unless I missed that not just the userland is replicated into it's own namespace but memory management via kernel-space replication is included as well

Ozymandias42: it's namespacing of filesystems, network (with vnet), processes. I don't know the specifics of Linux but in the general sense of "namespace" it applies to jails and those sets

so I guess it _is_ equivalent then. Namespacing of Filesystems is basically chroot, of network is included in linux namespaces, as is processes

so a FreeBSD Jail, at least non-service ones can probably be said to be equivalent to LXC containers as they include a full userspace and not just what is necessary to execude the application intended to be run in it like OCI (docker) containers often do. Though I guess this would be possible too for lighter jails

yes I think lxc and jails are similar enough

interesting..thx

there are even oci runners for using jails

Ozymandias42 as always, devil is in details. Isolation features are surface, the actual question about isolation is not that much about features but about if you can break out of isolation or not.

they both use the same kernel

yeah with the linux compat layer OCI runners make sense to be available.

if only Linux had ctrl+T/SIGINFO support too

tsoome I don't think the features are surface only. and you can break out of anything with enough effort. heck, you can break out of VMs to the hypervisor with side-channel attacks. so knowing the features is relevant to be able to judge how difficult a breakout might be.

ofc implementation of those features plays a large role and the freebsd ones are famously airtight here

well, you have to distinguish accidents and design flaws.

I guess. from how you're talking you're probably deeper into it than I so I take your words for it. My level of knowledge here is only functional not implementation level.

Is ASLR only concerned with the user space? The recent exploit made with Claude Code github.com/califio/publications/blo…n/MADBugs/CVE-2026-4747/write-up.md suggests it's not

rtprio: First guess re Dell: different iDRAC versions? Different BIOS versions?

rtprio: re power consumption

dvl: the non-working one is a drac express, the working one is enterprise

i don't have an exact memory but it used to work

rtprio: So, difficult to compare.

yeah. the other power commands seem to work, but on my systems `ipmitool delloem powermonitor` formatting always looks weird

Hi.. Strange we can not setup kubernetes on FreeBSD .. ?

or kubernetes cluster

i don't think kubernetes supports freebsd, no

i'm not sure you can yolo kubernetes with podman

it might be doable. there are OCI runtimes for freebsd. if you could use them with k3s or k3d you might get kubernetes to run on freebsd

it's perfectly doable, just no one has done it

feels like tech demo stuff to me. doable in theory but in practice it would just ask to run into edge cases when trying to use it productively. probably easier to just run k3s nodes as VMs in bhyve

i mean, kuberneteres does a bunch of system monitoring stuff (like free memory), i doubt it would just work right now. although i suppose you could try it

...though if jails can run linux userlands too via the compat-layer that could also work...

What FreeBSD filesystems are cleared on reboot? I know there's an option to clear /tmp but I'm thinking : is /var/run always empted?

ivy: thanks..

Tingo: there is podman.io

btw.. i like freebsd, it looks more secure then Linux..

this does support kubernates stuff and the freebsd foundation has been promoting its use

Yes, I think /var/run is emptied on boot, based on /etc/rc.d/cleanvar

yes, i know it support podman.. but i am thinking about orchestration level

and cgit.freebsd.org/src/tree/libexec/rc/rc.d/cleanvar?h=releng/15.0

Donno I'd call Linux less secure than FreeBSD, varies by distro but it is more popular and that's not always good.