I fixed it temporarily by adding an entry in hosts to pkg0.nyi.freeebsd.org IP for pkg.freebsd.org

Just wanted to check, it's not possible to ktrace from a host to a jail with jexec, right? Especially if the jail is a much older release...

so i pkg install squid, no problem. but pkg -r <jail root> install squid and it errors "install: nknown group squid" for /var/squid, /var/squid/cache, etc

does pkg -r have bug or? 14.4

what about "pkg -j yourjail install squid"

I don't think just changing the root is going to make it aware of in-jail users.

see the "pkg" manpage and the "-j" option.

lemme try

fuck

spork_css_ did you not see me say 14.4?

-j is 15 only

yeah, I just feel like it's been in there forever. I tested on an old 13.x host, so.... no idea.

all I know is from my reading of the manpage,

-r would not work

-j isn't in there

pkg supports -j since forever.

again, can't comment on that

WFM

just type "man pkg" and then "/" and then "-j".

kerneldove: Run "pkg" and see what it offers for options.

hm from command line pkg shows -j is an option. dunno what's up with man page site then

Man page on an installed 14.4 system will also show the option.

kerneldove: Oh, you selected section... 0? It's in section 8.

when i run sudo pkg install cowsay, works. when i run sudo pkg -j myjail install cowsay, it gives permission denied and fails with error updating repositories. why?

i just used whatever was default selected

kerneldove: I tend to chroot in instead, as jails can have some funny limitations. I've never dug in. I just pivot to something fairly simple that works.

it must be trying to run the pkg from within the jail, and it's hitting the firewall

that's a dumb way of running because not all jails have public network

that's why i was using pkg -r

but so then pkg -r fails with other reasons, ffs what a cluster

Yeah, everything's a bunch of tradeoffs. :/

well how the f have jails not matured to where you can properly install packages in them from the host system?

20 year old tech that has these basic gaps in lifecycle? embarassing tbh

kerneldove: Dunno. I chroot in. Works reliably.

what's that look like?

Shut the jail down, chroot in, install packages.

It's probably inelegant, but I'll take inelegant if it's boring and incident-free.

As I've noted previously, I'm sliding towards ever-simpler lately.

ya especially with so much sht half baked here

Oh, I wouldn't say that. FreeBSD is very reliable in a number of ways that other systems can't touch.

no offense but don't care what you'd say or not. the issue i just ran into proves what i said

OK, well for starters, if you want the manpage for the system you're currently on, you run "man" on that system and you will have the correct manpage.

It's much less work to type "man pkg" than to go to a browser and google it.

and many commands will just spit out a bunch of options if run with no options. This isn't poor OS design, this is just how unix is.

maybe the "-c" option will work for your setup, not sure. But trying to use a system (pkg) that relies on the internet to fetch packages on something without internet is a choice and an edge case, IMO.

spork_css_ cool so how to install pkgs into a jail that doesn't have networking? because -r and -j ain't it

should be able to install pkg into a jail from host system

no idea, I've never had a need to do it.

so every jail you use has inet?

kerneldove: Setting up NAT for them so they can reach out isn't a terrible idea.

yes

lol nice security model bro

do you want help or do you want to yell at people that aren't getting paid to do this?

yell? emotional much?

It's a reasonable characterization.

OK, insult people, how's that?

(and insulting people because you can't figure something out is kind of... emotional?)

stop obsessing

?

kerneldove: It sounds like a reasonable time to take a break. You're not making yourself happier. Maybe write up a bug with details of the failures you see with pkg -j and/or pkg -r when you come back, so something productive comes out of it.

`less` has a poorly-discoverable interface

Reinhilde: If you try --help it's pretty good, but -h could be more helpful.

decent manpage as well (and thankfully unlike most linux distros, typing "more" doesn't give you an ancient "more")

sad state of affairs here, one of my old junker PCs just freezes midway through the BIOS device iteration when a bootable USB key is in there that it doesn't like (which includes all FreeBSD memstick images)...

no BIOS updates, some hints in old forums that maybe gparted can whack it into shape, but it does have an optical drive...

so, behold this jank: i.imgur.com/sKCfxEv.jpeg

I have one of those, that needs two plugs to get enough power to burn.

yeah, honestly kind of shocked that current macos a) recognized it as a burner b) still has code to burn discs

-c and -j both fail trying to install pkg to a jail that doesn't have inet

and -r leaks shit across the jail boundary into the host and installs fail (squid)

junk

kerneldove: Wait, if these don't have Internet access, how are you supplying packages?

host has inet, jails don't

Mm. All the tools assume you have internet access. I'd probably set up an on-disk repository, maybe one that you nullmount in, and set up your repo config as needed to accomodate that.

Like, set up the config per-jail, so the jail expects packages in a particular directory.

That can be a read-only mount from the host.

The pkg tools expect networking.

That shot past me in the earlier discussion.

Use pkg fetch on the host to get the things. I haven't done this particular variation, so I'm not sure what pkg wants on the repo side.

You're going to need to treat these as being air-gapped in various ways.

Frankly I'd set up NAT so they can reach out. There's not a ton you can do on a system with no networking nowadays, so it's unusual to have something with no network.

kerneldove: how have you setup your jails? I have jails but do not have pkg setup inside of the jails. I use 'pkg -r' every day on a 14.4R system everyday, no issues.

:o

kerneldove: for j in /usr/local/jails/containers/*; do printf "\nUpgrading jail: ${j##*/}\n=========================\n"; pkg -r ${j} update && pkg -r ${j} upgrade; done

I run that every day

no issues.

depends on what you're installing - in kerneldove's case, he's installing squid, and that needs to add a user.

mns try installing squid to a jail with pkg -r and tell me if it gives error "install: unknown group squid"?

ya

I suspect that fails because it's not chrooted into the jail

spork_css_: I install lighttpd, and that needs a user as well, as I recall.

kerneldove: let me try that and see what happens

mns: "-r" just sets an alternate root, "-j" and "-c" both chroot into the jail.

If your jail had the lighty user in there before doing the upgrades, I'd guess that might work? I don't know.

I don't have a single jail that doesn't at least have internet access via NAT

anyhow, off to walk a dog, good luck, all

o/

spork_css_, kerneldove: I was able to install squid using the command that kerneldove provided, no issue. It went ahead and created the squid user inside my jail.

wtf

does jail have internet? using pkg -r from host?

what freebsd version?

kerneldove: doing it from host: sudo pkg -r /usr/local/jails/containers/lighty install squid

kerneldove: 14.4

hm same as me

and your extracting squid line wasn't followed by any install: unknown group squid stuff?

nope

host running zfs?

yup

not sure if it'd matter but is it a thick jail with its own base?

kerneldove: I am running a thinjail but I don't think that should matter in this scenario

how do you have your jail setup? which directory are you pointing to?

i'm running the pkg -r /jail/jails/myjail/ install squid during bsdinstall, not after the post-install reboot, not sure if that matters

jail fs was created with zfs reate -o mountpoint=/jail zroot/jail

and ln -s /mnt/jail /jail before that

what's under /jail/jails/myjail, is it usr/, etc/, dev/, etc. ?

yep

it might be because of bsdinstall, but I can't think of a reason why.

I have networking in the jail, but I do not have pkg setup inside the jail. Everything in terms of package management gets done from the host.

kerneldove: when you run your pkg command, did it also say that perl would be installed?

yep

What's the error you get?

got a working pastie site i can use?

bpaste.net works

let me check mine again

never mind, I got the same messages as you did. I was checking if the user got created inside the jail, which it did.

I didn't look at the messages from pkg properly as it prints out a bunch of messages after the install

ok now we're getting somewhere. so don't you think freebsd should have a way to install pkgs into a jail without the jail itself needing to do the networking?

I don't think its' the networking in this case. The package got installed, just that the post-install setup doesn't get done properly. /var/squid and the other directories get created, but when the ownership is supposed to be given, the post-install script is using the host's /etc/passwd instead of the one rooted at /jail/jails/myjail. I think a bug report would be good to fix it.

that wasn't my point. my point was that there's no way to propertly install pkgs to a jail, from host

(without the jail having internet, which is an unnecessary security hole)

kerneldove: Did you see where I mentioned null mounting a repository in from the host?

kerneldove: paste.debian.net/hidden/1a7155e6

Use -c instead of -r

mns tried -c, doesn't work. fails with transient dns resolution error or smth

mason no but that's a dirty hack

kerneldove: You're talking about security, but you've evidently never run airgapped systems.

kerneldove: look at my output, I got no such errors, the directories all have the right permissions and ownership, the user gets created, all inside the jail, but done from the host.

i'll try again but i know it didn't work for me

kerneldove: I deleted the previous install of the package in the jail, removed both squid and perl, and then did a fresh install from the host.

As you can see in my paste above, no messages. If you do a 'ls -l /jail/jails/myjail/var/' squid should have owner:group of 100:100 (because you're looking at it from the host, which doesn't know about squid user as that is inside the jail)