00:26:13 karolyi: hi, what did I break? :-) /me scrolls back 00:27:47 oh, this github issue is tickling something, hold on 00:28:03 right on 00:29:42 karolyi: can you tell me a little bit more about how DNS is configured on this system? 00:30:18 kevans: what details are you curious of? I'm open like a book :) 00:30:38 mostly: is it running a local resolver, or is the resolver external to the system? 00:31:15 a resolver external to the jail 00:31:30 external to the jail, but is it on the same system? 00:31:36 right now it's 'nameserver 127.0.0.74\noptions edns0 trust-ad' 00:31:49 yes it is 00:31:52 a-ha 00:32:13 chroot is a red herring, you're getting bitten by https://cgit.freebsd.org/src/commit/lib/libc/resolv?h=stable/14&id=6b0a4d67a952e999c39ee21a5e50122b13a6d391 00:34:05 there's a longer story behind things being forbidden from connecting to 0.0.0.0 00:34:33 how often are failing pkgs (fallout) rebuilt? 00:35:13 the cluster does a `poudriere bulk -a` in an infinite loop, more or less, so the answer depends on how long the rest of the run takes to get through 00:35:16 kevans: um, the jail has 127.0.0.74 on lo0 so that's its loopback address 00:37:43 and is there a way to know which pkgs are provided as binaries? 00:37:48 instead of just the port 00:38:31 karolyi: yes, but libc/resolv is specifically using INADDR_LOOPBACK (127.0.0.1) to connect 00:39:05 Xinayder: generally the answer comes from its license terms; the cluster doesn't make any special determination here, beyond whether the license terms allow packaging or not 00:39:45 (freshports can tell you if there are any packages for a given port anywhere, though) 00:39:52 freshports++ 00:40:11 kevans: so unless I explicitly specify that in a chroot-relative etc/resolv.conf, it won't talk to 127.0.0.74... makes a bit more sense, but I would never had guessed that INADDR_ANY can be 127.0.0.74 00:42:51 kevans, there's a table on the freshports page for a port, I didn't notice it before. I see now 00:46:58 karolyi: that's the problem with the previous state, INADDR_ANY was something like 'the first address configured' by some metric 00:47:11 it's a crap-shoot 00:47:42 well that crapshoot worked for my case :) 00:48:25 the jail starts up with that IP, it's is changing on redeployment (by an ansible script), but since INADDR_ANY found it, it was not an issue 00:48:28 some additional context for the overall problem with it: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=280705 00:48:40 I'll just reconfigure php to not be in chrooted mode then 00:50:07 ah yeah I've heard about that bug, it's how meta also evaded android sandboxing 00:50:26 and managed to track users across applications 00:51:21 i take the fact that paul vixie advocated for breaking connections to it after probably taking advantage of it in earlier days as probably a sign of some sort 00:58:20 welp 00:58:51 just read through the bug page, if it's better off this way, I can make my changes. just wanted to get to the bottom of it 01:02:57 yeah, sorry to be the bearer of bad news 01:03:33 at least we found out :) thanks no matter what 06:55:01 good morning. I have a technical question that I think might be faster and more comprehensively answered here than via searching the web or reading the handbook. 06:55:53 The question is this: What is the _technical_ difference between the Linux Container technology stack (namespaces, chroot, syscall filter, capabilities, bpf, etc.) and FreeBSD jails ? 06:56:36 because at a glance from reading over the handbook it seems like Jails are basically equivalent to linux namespaces 06:57:24 that is unless I missed that not just the userland is replicated into it's own namespace but memory management via kernel-space replication is included as well 07:02:30 Ozymandias42: it's namespacing of filesystems, network (with vnet), processes. I don't know the specifics of Linux but in the general sense of "namespace" it applies to jails and those sets 07:03:39 so I guess it _is_ equivalent then. Namespacing of Filesystems is basically chroot, of network is included in linux namespaces, as is processes 07:04:56 so a FreeBSD Jail, at least non-service ones can probably be said to be equivalent to LXC containers as they include a full userspace and not just what is necessary to execude the application intended to be run in it like OCI (docker) containers often do. Though I guess this would be possible too for lighter jails 07:05:53 yes I think lxc and jails are similar enough 07:06:08 interesting..thx 07:06:14 there are even oci runners for using jails 07:06:15 Ozymandias42 as always, devil is in details. Isolation features are surface, the actual question about isolation is not that much about features but about if you can break out of isolation or not. 07:06:30 they both use the same kernel 07:08:40 yeah with the linux compat layer OCI runners make sense to be available. 07:09:48 if only Linux had ctrl+T/SIGINFO support too 07:10:25 tsoome I don't think the features are surface only. and you can break out of anything with enough effort. heck, you can break out of VMs to the hypervisor with side-channel attacks. so knowing the features is relevant to be able to judge how difficult a breakout might be. 07:10:51 ofc implementation of those features plays a large role and the freebsd ones are famously airtight here 07:16:07 well, you have to distinguish accidents and design flaws. 07:17:12 I guess. from how you're talking you're probably deeper into it than I so I take your words for it. My level of knowledge here is only functional not implementation level. 11:33:49 Is ASLR only concerned with the user space? The recent exploit made with Claude Code https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md suggests it's not 11:48:13 rtprio: First guess re Dell: different iDRAC versions? Different BIOS versions? 11:48:45 rtprio: re power consumption 13:27:50 dvl: the non-working one is a drac express, the working one is enterprise 13:28:13 i don't have an exact memory but it used to work 13:28:15 rtprio: So, difficult to compare. 13:34:19 yeah. the other power commands seem to work, but on my systems `ipmitool delloem powermonitor` formatting always looks weird 19:05:28 Hi.. Strange we can not setup kubernetes on FreeBSD .. ? 19:06:10 or kubernetes cluster 19:08:49 i don't think kubernetes supports freebsd, no 19:13:20 i'm not sure you can yolo kubernetes with podman 19:13:40 it might be doable. there are OCI runtimes for freebsd. if you could use them with k3s or k3d you might get kubernetes to run on freebsd 19:13:55 it's perfectly doable, just no one has done it 19:14:48 feels like tech demo stuff to me. doable in theory but in practice it would just ask to run into edge cases when trying to use it productively. probably easier to just run k3s nodes as VMs in bhyve 19:15:27 i mean, kuberneteres does a bunch of system monitoring stuff (like free memory), i doubt it would just work right now. although i suppose you could try it 19:15:28 ...though if jails can run linux userlands too via the compat-layer that could also work... 19:15:55 What FreeBSD filesystems are cleared on reboot? I know there's an option to clear /tmp but I'm thinking : is /var/run always empted? 19:16:37 ivy: thanks.. 19:17:33 Tingo: there is https://podman.io/ 19:17:35 btw.. i like freebsd, it looks more secure then Linux.. 19:17:47 this does support kubernates stuff and the freebsd foundation has been promoting its use 19:18:40 Yes, I think /var/run is emptied on boot, based on /etc/rc.d/cleanvar 19:18:45 yes, i know it support podman.. but i am thinking about orchestration level 19:19:41 and https://cgit.freebsd.org/src/tree/libexec/rc/rc.d/cleanvar?h=releng/15.0 21:06:47 Donno I'd call Linux less secure than FreeBSD, varies by distro but it is more popular and that's not always good.