kerneldove: ssh forward on the host then?

wait nvm hmmm

polarian that won't work?

that's what i'd hope to do i think

honestly if the vnet jail is limited to the host network, then there is not going to be some elegate way which doesn't involve the host, if the jails are available on the local network, but not got a public IPv4 (IE: not WAN reachable) then you can simply transfer the file locally?

kerneldove: you could use git (or friends), push the asset there, and have the asset pulled back down

or push the asset to some webserver and pull it back down from the jail

well with docker type containers, the container host can do port forwarding to the container. i just assumed jails would have something similar

yeah you can, with pf!

the jails do have a private ip so that jails can be on the same private lan, if that helps?

would i connect to ip of jail host and it forwards to jail using its private lan ip?

match in proto tcp from any to $hostip nat-to $jailip

sorry no

match in proto tcp from any to $hostip port $someport rdr-to $jailip

there you go

thats what you want

actually

you want to do

and hostip is like 10.1.1.5 (my home lan) or 1.2.3.4 (public ipv4 at a colo) and the jailip would be like 192.168.15.20? (192.168.15/24 being the private lan for the project, so its various jails can all talk to each other on that private lan)

match in on $hostif proto tcp from any to $hostip port $someport rdr-to $jailip

the hostip is the ip of your jail host, and then the jailip is the ip address of the vnet jail

and you want this to be only matching against packets coming in on the host interface

but you get my point about the vnet jail's ip being in a private lan subnet?

aka the interface which connects it to the local network

kerneldove: yes but the host can reach said subnet

ok so that's supported, nice!

so you can just do packet redirection

rdr-to is pf's way to redirect packets, aka "port forwarding"

the port(s) you specify are redirected to the IP you specify

ok that's great, seems this is a solution. i had no idea the public ip of the host could be used to 'bridge' onto the private lan subnet of a set of jails

that's really great

tyvm

this relies on the host being able to access the internal networks

I assume its configured with an epair right>

?

polarian can i forward the port to a different port on the jail? that way each jail can have normal ports

ya epair

like 5522 forwards to 22

5622 forwards to 22 of a different jail's private ip

etc

kerneldove: yes iirc you just specify the jail port after

so

ok nice thought so

match in on $hostif proto tcp from any to $hostip port $someport rdr-to $jailip port $someotherport

I think...

:)

I mainly know pf from OpenBSD, it differs slightly, but afaik that is the correct syntax

man i've been so stressed wondering how tf i'm gonna allow network access to select services (ssh/rsync/sftp) in jails without giving them public ips

i guess this scheme makes pinging jails impossible unless i created host forwards for that too?

(not a deal killer jc)

kevans: any docs to debug loader stages?

polarian do you know about ping forwarding too?

some of MWL's footnotes are just good life advice: "If you don’t like your vendor’s answer, ask more loudly and with malice aforethought."

how do you install pkgs into a jail that doesn't have public internet access?

You can setup separate routing in a gaol?

gaol?

i assume i can't use pkg -j since that runs from within the jail

kerneldove: yeah?

so freebsd-update -j operates ON the jail, but pkg -j operates IN the jail? seems weird inconsistent

freebsd-update -j is more like pkg -r

but with the path resolved from `jls`

would be nice if pkg had that too :/ seem slike a gap

You can give it a VNET to work with and then use ipfw or whatever to block traffic

Is that what you are refering to?

wut

got d/c

wut?

dumb question, but is there any efforts to bring the openbsd pledge/unveil stuff into the FreeBSD kernel?

capsicum seems to be well nobody gives a shit about it and doesn't want to mess with it, and pledge/unveil stuff seem readily adopted

i mean at this point its okay to say maybe we were wrong and this is a better option etc

I just worry because of the AI find exploits thing and its going to be predominately 3rd party stuff and we have zero way to protect ourselves from it

does actually noone give  shit about capsicum?

no

it hasn't seen widespread adoption, but we still deploy it in base utilities

nobody ever evangelized it that I'm aware of, couldn't even give you a one sentence summary of what it is but I guess SE-Linux-like?

hopefully it keeps being spread into base

like ucl and other freebsd tech, constantly spreading slowly but surely

like jails spreading to now have service jails

well it just seems like capsicum is very difficult to implement

so, it doesn't get implemented

i dunno, maybe there are options here

spork_css: selinux is more like MAC

except gross

lol

you boot a linux system and see that selinux is enabled, your first thought is "ah shit"

MAC? nah, it's helpful. it removed root from ntpd like a good guy

IIRC it's like someone's thesis originally or something? some relation to oxford? I only have vague vibes on it.

granted in SELinux they're trying to tackle the userland security at the kernel level but they don't have a userland

FreeBSD does

the last thing FreeBSD introduced where I just jumped in really, really early was ZFS. Prior to that a 2.2.7-stable snapshot where CAM was brought in (we had a fancy RAID controller that in some way required something that CAM introduced - I think something really silly like addressing multiple LUNs or something.

if you install a pkg with pkg mypkg, then you install the same pkg again with a jail root like pkg -r ... mypkg, will it download mypkg again or is there a cache that'll be used?

yea i remember when some jerkass mentioned about boot environments with zfs being a killer feature in solaris

kerneldove21: iirc pkg -r sandboxes itself to the root these days, it wouldn't have access to system cache

don't quote me on that

We ran some stats to compare running just a pair of (very expensive at that time) SSDs for postgresql servers to a pair of "enterprise" 7200 RPM SATA drives, but backed with a pair of small Intel 320 SSDs as ZIL/L2ARC and that's when we bought in fully.

The ZIL basically let us *safely* cache atomic writes at SSD speed instead of HD speed is the most basic way to explain it.

swap && zfs is a hairy thing to me but aside from that zfs is gold

So a filesystem saved us a shitload of money.

I still don't put swap on zfs, I imagine it works now, but I still partition the same - gpt w/boot - swap - zfs (or add in EFI if you're doing that)

ya i don't use swap unless i'm running single disk zfs

I think part of what swayed us was that lots of people with influence in the PostgreSQL community were banging on it immediately, and there were also people running PG on Solaris back then, so they came in with knowledge.

since it's late night, some #social-ish material: imgur.com/a/Il89ch4

unpacking and finding 90's things...

Walnut Creek, nastolgia

so instead of running pkg within a jail, and running pkg ON a jail, i change pkg bootstrap -f to pkg -r /zroot/jails/myjail bootstrap -f?

kenichi: you cant ping something which you do not have access to.

it would eliminate the point of ICMP

kenichi: as for pkg installation on airgapped containers, you can proxy the pkg repository using nginx on the host, and then you use the nginx on the host to install ports

someone spoke about this recently on XMPP

sorry I meant to ping kerneldove not kenichi I am so sorry...

oh wait kerneldove isn't even in the channel

question, how many people here would refuse to attend an event if it was branded under FSF(E)? Would you attend an event if it was simply sponsored/supported by FSF(E)?

I am finding it difficult to mix FOSS circles (FSF(E) endorsed) with BSD, because well... BSD folks tend to hate FSF(E)

intentionally keeping this out of the ML, as I dont want drama around it, I just want an honest response from the community without archives

polarian: There's a huge difference between hating the FSF as an entity (which I kinda do because they're so busy protecting Stallman), and FSF-endorsed stuff.

Free Software is great, happy to take your money and tell you as an entity to go pound sand. (If grants require FSF influence, that's money with ropes, not strings)

wavefunction: tl;dr I have an offer from FSFE I am turning down

they want the branding for a series of meetups I am planning in London

however its targetted at FOSS entirely, incl BSD

last time I helped organise a FOSS meetup it was sponsored by FSF and BSD people got a little... yk...

I know FSFE is a lot more mild than the FSF so probably wouldnt be as controversial, but still

I will be running a meetup on 8th and I will let them take the branding for it

but in the future I ideally want my own branding and for it to be across many groups (BSD, XMPP, FOSS)

im not even looking for funding, all I wanted from the FSFE was advertisement, which they can do for free. Plus I donated to them :)

I was originally looking to make a BUG (BSD User Group) but FOSS in the UK is in a bad place right now (little to no functional linux user groups, hackerspaces are actually makerspaces and are pretty hostile to free software in some cases), so I have pivoting to combine and run a joint effort for FOSS+BSD+XMPP

but I cant combine 3 different interests together if I then brand it as a FSFE event, can I?

I want it to be flexible, I dont want to be locked into a name or into a organisation which is advertising (or potentially funding) it

anyways, I need to get the whole FDE stuff sorted because one of the servers which I want to use for it needs it done :)

so instead of running pkg within a jail, i'm switching to running pkg ON a jail, and that means i change jexec -l myjail /bin/sh -c "pkg bootstrap -f | cat" to pkg -r /zroot/jails/myjail bootstrap -f | cat right?

kerneldove: yes that *could* work

but you wont be able to bootstrap pkg without network access in the first place

you can copy /usr/ports into the jail (or mount it as a nullfs)

and then make install the port

network access where? the jail host has network access, the jail shouldn't

yes

WHERE

to bootstrap the jail you need network access, your command is jexec the boostrap inside the jail

"pkg boostrap -f | cat" is ran within the jail

pkg bootstrap requires network access

uh ya

i didn't ask that

then I am not sure what you are asking/

i said that's the current command. i want to change it to run pkg -r

so instead of running pkg within a jail, i'm switching to running pkg ON a jail, and that means i change jexec -l myjail /bin/sh -c "pkg bootstrap -f | cat" to pkg -r /zroot/jails/myjail bootstrap -f | cat right?

read the whole question pls

oh right

no you dont need to boostrap the jail then

afaik you can just use the -r flag with pkg on the host, and it will install the files into the directory

I think!

you will need to test it

eg try

pkg -r /zroot/jails/myjail install cowsay

then run cowsay within the jail

if it works as expected, it should work!

so is there a freebsd dev willing to help me with debugging stage 1 loader to find out why its either ignoring loader.env or there is some bug in it?

im not giving up on this :)

sorry, dealing with ports tree things

ah yes that fuck up, one of 3 in 48 hours xD

seems like hell quite frankly, someone should buy ya'll a coffee (or a beer to drown out the suffering)

polarian: i'm not a dev, but i read part of the previous conversation about this. my question is, would it solve your problem if you use gptboot instead of gptzfsboot? or does this also present the same hard-coded value?

jmnbtslsQE: gptboot is for ufs afaik

but no

this is stage 1, and the issue lies with potentially either the parsing of the loader.env, or a bug within the stage 1 loader

that is what I need to debug, but I dont know how to do this, and I will have to wait for a dev to become available to help mentor :p

OK, i just thought that if gptboot had the value you wanted, you could put your kernel in a ufs partition then mountroot from a separate zfs-on-root partition

polarian: i think you can move the devinit() call in loader's main() down a little bit to after we've adjusted `howto`, but i suspect this will not be enough

polarian: i think the bits that read loader env would also need to move above cons_probe()

i think both are safe to make, but it'd be worth confirming if you have the time. just don't install either as loader.efi / bootx64.efi, install as a new one and create an `efibootmgr` entry for the test loader

actually, maybe leave the ordering of loader.env w.r.t. `cons_probe()` alone fr the moment, it installs hooks that may just do the right thing

how to patch kde2 for freebsd?

как пропатчить кде2 под фрибсд?

:/

how to patch kde2 for freebsd?

I think you might have a network problem. Your ping is 26 years.

lol or just lagged and now you're in the future

is nvidia-driver-470 still supported on freebsd? if yes, which version of freebsd is recommended?

if not, are there any out-of-tree patches or ports to make it work on the latest release?

black_mambet: yes it is still supported and it works on the current release and no patches needed

x11/nvidia-driver-470

I run FreeBSD 15.1 in different machines as both a host (bhyve/Sylve) and as a virtual machine. I noticed there was a new warning about issues in ports repository freeze, also I noticed that if I run pkg update and pkg upgrade I see a ton of things being reinstalled/upgraded. I hope this is normal if anyone has any insight let me know! FreeBSD's announcement: lists.freebsd.org/archives/freebsd-announce/2026-July/000294.html

markmcb: did you update your pkg package?

sorry mary751

I thought pkg package updates in pkg update && pkg upgrade

those are unrelated, the freeze is just a git-side cleanup.

looks like someone commited a 150mb blob, that must have broke the github mirrror and it doesn't touch the pkg at all

prabably the big reinstall list is just the pkgbase

what does, pkg which /usr/bin/uname

it say FreeBSD-runtime ?

i need to set up port forwarding through the public ip to the private ip of a jail, using pf. can i just enable gateway_enable or do i need to set net.inet.ip.forwarding = 1? or both?

that's all gateway_enable does iirc

ok i'll go through that

tyvm and nice scotch