<story><title>FreeBSD Jails for Fun and Profit (2020)</title><url>https://topikettunen.com/blog/freebsd-jails-for-fun-and-profit/</url></story><parent_chain><item><author>drclau</author><text>FreeBSD Jails were so much better than everything else out there, for a long time. I&amp;#x27;ll just copy&amp;amp;paste part of a comment I wrote on another HN thread some time ago, since it&amp;#x27;s relevant here:&lt;p&gt;[...] In fact, many years ago, when FreeBSD was my main OS (including on notebook) I went as far as to isolate each app that used internet into its own custom-setup jail [0][1].
I had Firefox, Thunderbird, Pidgin and a few others running in complete isolation from the base system, and from each other. I even had a separate Firefox jail that was only allowed to get out via a Tor socks proxy to avoid leaks (more of an experiment than a necessity, to be fair).
Communication between jails was done via commonly mounted nullfs. I have also setup QoS via PF for each of them.
They were all running on the host’s Xorg, which was probably also the weakness of this setup.
It was a pretty sweet setup, but required quite a bit of effort to maintain, even tho I automated most of the stuff.
[...]&lt;p&gt;The original comment is here: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=27709256&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=27709256&lt;/a&gt;</text></item></parent_chain><comment><author>cnst</author><text>Sounds pretty cool! TBH, I don&amp;#x27;t understand how the &amp;quot;modern&amp;quot; app security models are not deemed to be fundamentally insecure in 2021 where any random app on any random system can simply leak your whole photo library to their servers, or delete all your files. Why do banking apps need full access to my filesystem? Why don&amp;#x27;t the reviewers of the app stores prohibit such practices of excessive permissions?&lt;p&gt;Yes, there&amp;#x27;s always a question of usability, but if you&amp;#x27;re an advanced user, it&amp;#x27;s still scary that you&amp;#x27;re not afforded any control to prevent these incidents unless you go ahead and redesign the whole way all these apps are working all by yourself.&lt;p&gt;It seems terribly inefficient if every engineer has to do it on their own, and in their own incompatible way. Obviously most people simply give up after a while, since maintaining such a setup might itself be a whole full-time job.</text></comment>
<story><title>FreeBSD Jails for Fun and Profit (2020)</title><url>https://topikettunen.com/blog/freebsd-jails-for-fun-and-profit/</url></story><parent_chain><item><author>drclau</author><text>FreeBSD Jails were so much better than everything else out there, for a long time. I&amp;#x27;ll just copy&amp;amp;paste part of a comment I wrote on another HN thread some time ago, since it&amp;#x27;s relevant here:&lt;p&gt;[...] In fact, many years ago, when FreeBSD was my main OS (including on notebook) I went as far as to isolate each app that used internet into its own custom-setup jail [0][1].
I had Firefox, Thunderbird, Pidgin and a few others running in complete isolation from the base system, and from each other. I even had a separate Firefox jail that was only allowed to get out via a Tor socks proxy to avoid leaks (more of an experiment than a necessity, to be fair).
Communication between jails was done via commonly mounted nullfs. I have also setup QoS via PF for each of them.
They were all running on the host’s Xorg, which was probably also the weakness of this setup.
It was a pretty sweet setup, but required quite a bit of effort to maintain, even tho I automated most of the stuff.
[...]&lt;p&gt;The original comment is here: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=27709256&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=27709256&lt;/a&gt;</text></item></parent_chain><comment><author>vegai_</author><text>Is there a reason why FreeBSD doesn&amp;#x27;t default to running all applications in jails? Seems like this would be a pretty huge advantage compared to the typical Unix system&amp;#x27;s almost complete lack of sandboxing.</text></comment>