How I got fired from my first tech job

My daily routine is usually the same, wake up, go to work, do a lot of meetings, chat, email, code, sleep and repeat. Which means that I don’t have new things to talk about. However, since I decided to blog regularly, here’s a blast story from the past πŸ™‚

I grew up in Syria and it’s a cultural thing that we work from a very early age. I got my first job when I was 11 years old. During the summer I worked as a stonesetter, my salary was 200 Syrian Liras per week, back in the day that would be 4 US Dollars.

I loved that craft, looking deeply into the pins and understanding where the gems and diamonds would go, how to close the pins properly so it would sit there for years.

However, I also had a love for computers, I got interested when I was introduced to Unix, I wanted to use Aircrack-ng to hack the neighbor’s WiFi Access-Point so I get free internet access. Inet access was not only expensive, but you had to wait 6 to 12 months to get one. I got Slitaz Linux up and running, it included Aircrack-ng in it and cracked the network, I still remember the password, it was 11111222223 with WEP algorithm. Hrach, if you are reading this, I’m sorry that I never told you about it, but thanks to you I got into computers πŸ™‚

When I was 14 I had to deliver gold to a partner workshop, on the way, right at the beginning of Sulaymaniyah Street I noticed a large computer shop. Very beautiful, a lot of computers, laptops, hell, there was a gaming PC with 3 screens (That was the first time I saw a desktop with 3 screens!). After I delivered the gold, on my way back, I entered the shop, I got introduced to the owner. Turns out they were an official representative of companies like Dell, HP, Asus, etc.

I talked with the owner about some of my projects, that I was installing Linux machines in school and that I was trying to make a map with all access points in Aleppo with their passwords.

After 20-30 minutes of chit-chat, he offered me a job. I was supposed to 1) Format computers (as we used to say), that is installing a fresh OS and setting up software 2) Help the other employee to deploy networks at schools 3) Help customers buy new computers when they arrive.

I worked there for 3 months, I was getting paid 250 Syrian Liras per week, that is 5 USD back in the day, plus some bonuses every time I would sell a device or fix networking issues at the schools.

One day customers arrived (a man with his wife), they were having problems with a laptop that they owned, I fixed the issue on the spot and asked nothing in return. They asked if I could come and fix a similar issue on their desktop at home, I told them I would but I cannot right now as the owner is not here. I wanted to give them a business card to call us later but we were out of those, so I gave them my cellphone number.

An hour or so later the owner came back, I told him about what happened and went back to my room to fix an HP laptop that had a melted keyboard and I started blaming AMD for that πŸ™‚

The couple called, I told my boss, he told me “Okay, go to their place and fix it, don’t charge them anything”. So that’s what I did.

I came back to the office an hour later, the owner was sitting in front of his desk and told me to sit in front of him. Then he said, “Are you trying to steal my clients?”.

I got confused, I had no idea what is he talking about, “Sorry, what do you mean? I didn’t understand what are you implying”. He answered, “You gave them your cellphone number, so they start calling you and pay you instead of us. You’re fired”.

I didn’t know what to respond, I didn’t have those intentions, I was just doing my job.

I took my backpack and I left. I was crying the entire time, walking back home, listening to Star Wars Galactic Battlegrounds’ OST.

To make things worse, when I arrived at home my mother told me “Why are you so much into computers? It’s not that it even pays well, you know you have to study and graduate Pre-Secondary Education this year”, little did she know, that as of right now, I will not be paid at all while “doing computers”.

Years have passed and I moved to Armenia during the Syrian war. While working as a waiter for a year, I found an “Armenian Linux” and the company responsible for it, Turns out they were a huge software development company. I wrote a patch for the “splash screen”, I gave them the patch, on a USB drive.

The CEO of the company said “What are you doing next Monday?”, “I have to go to university” I replied, as I was an undergrad learning English and Communications. “Well, after the university you’re coming here, you’re hired”.

Oops, flashbacks, what am I supposed to do now?

I looked left and right, there were all these desktops running Linux, the engineers on the top floor were working on robotics, so I said “Deal!”.

I learned that day, that no matter how bad of an experience you get, the next time will probably be different. Unless it’s Windows, that thing always fails.

That’s all folks.

Reply via email.

VNET Jail HowTo Part 2: Networking

As always, Dan has been tweeting about VNET Jail issues, which means it’s time for another VNET Jail post.

This post assumes that you’ve read the original post on VNET Jail HowTo.

In Part two we will discuss Networking.

We will use PF as a firewall to do things like NAT.

If you need more help please check the FreeBSD Handbook: Chapter – Firewalls or send me an email/tweet.

At this point (from the last post) we were able to ping from the Jail to the Host.

root@www:/ # ping -c 1 10.0.0.1
PING 10.0.0.1 (10.0.0.1): 56 data bytes
64 bytes from 10.0.0.1: icmp_seq=0 ttl=64 time=0.087 ms

--- 10.0.0.1 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 0.087/0.087/0.087/0.000 ms

Now we will setup PF on the host by adding the following to /etc/pf.conf

ext_if="em0"
jailnet="10.0.0.0/24"

nat pass on $ext_if inet from $jailnet to any -> ($ext_if)

set   skip on { lo0, bridge0 }
pass  inet proto icmp
pass  out all keep state

We also need to enable IP Forwarding in the kernel

Add the following in /etc/sysctl.conf

net.inet.ip.forwarding=1

And now execute

sysctl -f /etc/sysctl.conf
service pf restart

That should be it, now your Jail should be able to ping the outside world

root@zvartnots:~ # jexec -l www
You have mail.
root@www:~ # ping -c 1 9.9.9.9
PING 9.9.9.9 (9.9.9.9): 56 data bytes
64 bytes from 9.9.9.9: icmp_seq=0 ttl=61 time=2.566 ms

--- 9.9.9.9 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 2.566/2.566/2.566/0.000 ms
root@www:~ #

If you setup a resolver, you should also be able to ping domain names as well.

root@www:~ # echo 'nameserver 9.9.9.9' > /etc/resolv.conf 
root@www:~ # ping -c 1 freebsd.org
PING freebsd.org (96.47.72.84): 56 data bytes
64 bytes from 96.47.72.84: icmp_seq=0 ttl=53 time=133.851 ms

--- freebsd.org ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 133.851/133.851/133.851/0.000 ms

Now, for a more complicated setup that assumes no firewalls and multiple IP addresses, where each Jail has its own IP address. I have a similar setup at home where my ZNC server Jail has its own IP address by connecting the physical NIC to the same bridge as the ZNC Jail.

In my rc.conf on the host

ifconfig_em0="inet 192.168.0.34 netmask 255.255.255.0"
defaultrouter="192.168.0.1"

cloned_interfaces="bridge0"
ifconfig_bridge0="addm em0"

Here’s an example with jail.conf

znc {
	$id		= "52";
	$addr		= "192.168.0.252";
	$mask		= "255.255.255.0";
	$gw		= "192.168.0.1";
	vnet;
	vnet.interface	= "epair${id}b";

	exec.prestart	= "ifconfig epair${id} create up";
	exec.prestart	+= "ifconfig epair${id}a up descr vnet-${name}";
	exec.prestart	+= "ifconfig bridge0 addm epair${id}a up";

	exec.start	= "/sbin/ifconfig lo0 127.0.0.1 up";
	exec.start	+= "/sbin/ifconfig epair${id}b ${addr} netmask ${mask} up";
	exec.start	+= "/sbin/route add default ${gw}";
	exec.start	+= "/bin/sh /etc/rc";

	exec.poststop   = "ifconfig bridge0 deletem epair${id}a";
	exec.poststop  += "ifconfig epair${id}a destroy";

	host.hostname = "${name}.bsd.am";
	path = "/usr/local/jails/${name}";
 	exec.consolelog = "/var/log/jail-${name}.log";
	persist;
}

And that’s pretty much it!

That’s all folks.

Reply via email.

Migrating home-servers

As I have mentioned before, I want to blog more, so here it goes.

I’ve been struggling financially lately, with COVID and then the war I’ve thrown away almost all of my savings. One of the decisions that I had to make was moving back to my old place. No one lives here anymore, my parents got their own house, which means I can live with freedom alone and rent-free.

That meant I need to move home servers again. Yes, I’ve always been a home server fan. This blog runs on my home server as well.

While many people argue that running a home server is a complex process compared to the cloud, since you need to pay for electricity and manage hardware, I, however, feel that’s a myth.

My current uptime is

ssh pingvinashen uptime
1:59PM up 48 days, 42 mins, 2 users, load averages: 0.15, 0.18, 0.21

And I only needed to reboot because I had to upgrade since I’m a fan of upgrading whenever there’s a patch to some critical software πŸ™‚

One of the advantages of running a home server in Armenia is the fact that electricity is cheap, so are static IP addresses. I pay 2USD/mo for each IP address and I have many of them.

Usually, I have one static IP per service (Jabber, ZNC, etc.) and one static IP for all web-oriented services such as blogs, websites, etc.

However, norayr also runs a home-server for the community, he runs the Armenian instance of Diaspora*, Mastodon, and SocialHome.

Due to technical limitations at his side of the city, he’s been keeping his home server at my place.

Vartanian LLC, Home-Server as a Service πŸ˜›

Anyways, I had to bring his home server to my new/old place as well, which meant that he needs a static IP for his services.

I did not want to call the ISP for a new IP address since the last one I’ve been using was for an Armenian instance of Lobste.rs that I deployed for our community. It’s not very active, but you can’t force people to be active in communities and Armenia does not have the concept of “tech communities” like others do in the west.

That meant that I have to remove an IP from a Jail so norayr can use it.

So I had to migrate some things. I had to use my proxy server IP address and reverse_proxy the traffic to the lobsters’ Jail.

Sounds easy, until I remembered that I run Apache on my host.

I’m not very fluent in Apache, I keep doing mistakes, so I wanted to migrate all of my vhosts to Nginx.

You’d think that it would be easy, and yes it was πŸ™‚

So now, norayr runs his home server and I have migrated the webserver to Nginx in an hour.

For some reason, it feels faster, but I’m still not sure why. I probably had to optimize Apache back in the day, but Nginx’s default configs do seem better.

Now, since many IP addresses have been changed, I have to struggle with SMTP issues. No, SMTP works fine, but Google, just like it keeps breaking the web, it keeps breaking email as well, routing all-good emails to people’s spam folder, eh.

That’s all folks.

* not a footnote but part of the project name.

Reply via email.

Blogging Regularly

Ruben blogged recently about blogging regularly and it kind of hit me: Why don’t I blog regularly?

I love blogging. I improved my Armenian by blogging for years, I wanted to be a blogger so bad that I asked my friends to rent me a domain and a hosting service since I didn’t have money when I moved to Armenia after the war.

But yet again, it’s very hard for me to write my thoughts in English. Armenian? Yes, sure, I can write a very complex sentence very easily. English, however, the language that I think in, the language that I grew up having a love&hate relationship with, is not the language that I’m good at writing. I can talk English very well, at least I’ve been told, but writing is not there yet.

There are a lot of points that Ruben made that I love to be more mainstream. Use ANY blogging platform, literally any, as long as they don’t treat you as the product (Medium as an example). Write about anything, everything. I would love to hear about your daily life, how you solve problems, no matter if it’s about that very complex DB issue you’ve been having or the water pipe that has been leaking. They are all interesting.

At the end of the day the internet is the place that allowed everyone to speak. Now we are fighting over who gets to be heard.

But with blogs and RSS, everyone will be.

That’s all folks.

Reply via email.

Flickr’s Uploads from everyone from The Future

I like using RSS, I have Miniflux running in a FreeBSD Jail all the time. Lately I noticed that it’s not very handy to open up Flickr every hour to see photos by my friends, so I decided to use their RSS feed.

First of all, I’m so happy that Flickr provides an RSS feed, it’s an amazing standard and I wish more websites and services implemented it, or at least, not remove it πŸ™‚

So I go to Norayr’s Flickr page, and since Firefox removed RSS I do Ctrl-U to see the page source. I search for the term RSS and I find nothing, I search for atom and I find a link!

I copy the link and I add it to my Miniflux feeds. I hit refresh and I see the following.

Okay, so looks like those are photos… from everyone… on Flickr… from the future.

I KNOW that my time is synced, because I always have NTP running. After some digging, I figured that those posts ARE from the future. Flickr calls them “scheduled” posts.

Doing a little more digging, and I realize that I did not copy the full link with id=norayr's_id and now I’m seeing everyone’s feeds.

That’s all folks! πŸ™‚

Reply via email.

macOS to FreeBSD migration a.k.a why I left macOS

I think the title tells a lot about the story I’m going to tell you.

This is not a technical documentation for how I migrated from macOS to FreeBSD. This is a high-level for why I migrated from macOS to FreeBSD.

Not so long ago, I was using macOS as my daily driver. The main reason why I got a macbook was the underlying BSD Unix and the nice graphics it provides. Also, I have an iPhone. But they were also the same reasons for why I left macOS.

I did not want to write this post right after the migration, I wanted to take my time, use FreeBSD daily, see if I will ever miss macOS.

Here’s a tweet of mine from 8 months ago

Let’s look at it this way. macOS is becoming less Unix-y every year, date(1) is outdated, there are 100+ Unix processes running by the time the system is booted, most of them are useless for the general user, it has no native package manager (at least MacPorts/homebrew/pkgsrc is out there) and for a power user, there is no proper documentation. Have you ever checked the FreeBSD handbook? Everything is right there!

Okay, the nice graphics part. Have you seen the latest and greatest Big Sur? It feels like eye-candy, it’s not made for power users at all, everything seems to be a distraction now, even the icons. I’m no UI guru, but bringing iOS to the desktop is not for everyone.

So I decided to move to FreeBSD. This is where many people will tell me “Okay but not everything works outside the box”, true! but which OS works outside the box these days anyway? Windows is still a nightmare, setting up macOS took me 3 days the last time, Linux takes way more if you’re building it from scratch. Setting up FreeBSD took me 3 days, however this meant that I will NOT need to change it again for a very, very, VERY long time.

Every time Apple pushed an updated, my pf.conf and automount configs got broken on macOS. They either got deleted or they moved somewhere. Well, the last 2 times it just got deleted.

On FreeBSD, I upgraded from 12.1-RELEASE to 12.2-RELEASE and nothing broke, and in case there were any changes, FreeBSD just asked me what to do about them.

Let’s come back for a second. Unix is outdated and Apple does not care about it, fancy graphics are too fancy now. Doing forensics is almost impossible. And the hardware is, well, not the best out there (have you ever disassembled a MacBook Pro? it’s takes 2 hours to change a battery while I can reassemble my Dell Latitudes and ThinkPads in 30 minutes).

So there was no reason to stay here anymore. I had to migrate. The question is: where?

Linux has systemd, not my favorite thing out there, Windows is privacy nightmare. That left me with 2 major options: Linuxes without systemd (Gentoo, in my case) or BSDs.

Since I run FreeBSD servers anyway, I just migrated to FreeBSD.

Here’s a short review about running FreeBSD on ThinkPad T480s.

  • WiFi: works. not the fastest, but fast enough.
  • Graphics: works.
  • Touchpad: works with multiple fingers AND very configurable via sysctl.
  • BT does discovery and pairs, I still have to try it with non-Apple headphones.
  • COVID-19 era: Zoom, Google Hangouts, Jitsi and all other WebRTC-based video conferencing software works via web as well.
  • Thanks to Linuxulator, I can watch Netflix as well: here’s a screenshot.

Most importantly, it’s Free and Open Source.

It’s been 1 month and 1 day since I last touched my MacBook Pro, so, what do I miss?

  • Better BT support
  • Faster WiFi

That’s it, that’s all missing on a FreeBSD laptop these days. WiFi can do 48Mbps according to ifconfig but I usually get 10-20Mbps. BT pairs with my Apple AirPods but I wish it worked till the end.

Having a nice workstation/laptop is not an easy thing, using macOS means living by Apple rules, Windows is the same for Microsoft. The BSDs gave me the power to be as free as possible πŸ™‚

During the next weeks I’ll try to blog about the actual setup.

P.S. dear Apple employee, in case you’re reading this, please tell your management to update their BSD Unix layer. Some of us still care, some of us are not just Docker people, some of us are not just “modern” web developers. Thanks in advance.

That’s all folks! πŸ™‚

Reply via email.

Signal-cli with scli on FreeBSD

So couple of days ago I migrated from macOS on Macbook Pro to FreeBSD on ThinkPad T480s.

Unfortunately, since we are in war, I do not have the time to blog about the migration, although I’m taking notes every day about every change that I do so I can blog later on πŸ™‚

However, one of the biggest concerns for me was running Signal on FreeBSD, as I understnad, Signal people are not interested in supporting the *BSDs.

As any sane person, I started searching the internet for possible solutions and turns out all I need is two pieces of software

The installation is as easy as running

pkg install signal-cli scli

Now for the simple part.

First, you need to link your phone by running

signal-cli link -n "FreeBSD"

It will give an output that says tsdevice:/?uuid=...&pub_key=....

Copy that output, and then in another terminal run

qrencode 'tsdevice:/?uuid=...&pub_key=...' -t ANSI256

You will be represented by a QR Code in the console (cool, aye?).

Using the phone app, link the device by scanning the QR Code.

To receive list of your contacts run

signal-cli -u +myphonenumber receive

Now try to run the TUI interface by running

scli

Side-note: In case you are not able to send or receive messages, you might need to do some DBUS magic.

First, find if you have DBUS running

antranigv@zvartnots:~ $ ps -x -o comm,pid | grep dbus
dbus-launch         53571
dbus-daemon         54064
dbus-daemon         54963

Then, you will need to find the DBUS_SESSION_BUS_ADDRESS environment variable, this is usually set in the DBUS child process, in our case, it’s 54963, so we can use procstat as root

root@zvartnots:~ # procstat -e 54963
  PID COMM             ENVIRONMENT                                          
54963 dbus-daemon      SHELL=/usr/local/bin/bash DBUS_STARTER_ADDRESS=unix:path=/tmp/dbus-TaY0zoKZIb,guid=4f518f874f97170e788a94fb5fa14a3c DISPLAY=:0.0 WMAKER_BIN_NAME=wmaker PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:/home/antranigv/bin WINDOWPATH=9 MAIL=/var/mail/antranigv GTK_THEME=Adwaita:dark DBUS_SESSION_BUS_ADDRESS=unix:path=/tmp/dbus-TaY0zoKZIb,guid=4f518f874f97170e788a94fb5fa14a3c USER=antranigv DBUS_STARTER_BUS_TYPE=session MM_CHARSET=UTF-8 WRASTER_COLOR_RESOLUTION0=4 PWD=/usr/home/antranigv BLOCKSIZE=K LANG=en_US.UTF-8 LOGNAME=antranigv HOME=/home/antranigv

Okay! we have our variable!

Now, we need to set the ENV and we are done, if you use (t)csh then execute

setenv DBUS_SESSION_BUS_ADDRESS unix:path=/tmp/dbus-TaY0zoKZIb,guid=4f518f874f97170e788a94fb5fa14a3c

If you are using bash, run the following

export DBUS_SESSION_BUS_ADDRESS=unix:path=/tmp/dbus-TaY0zoKZIb,guid=4f518f874f97170e788a94fb5fa14a3c

Now, you can run scli again and it will work fine πŸ™‚

Happy Chatting!@#$%

That’s all folks! πŸ™‚

Reply via email.

Erlang dbg Intro

If there’s one programming language that changed my life, that’s Erlang. After using Erlang for couple of years, I “moved” to Elixir, which is based on Erlang’s VM.

One the most important aspects of Erlang’s VM is that it’s a “real” VM, there’s a kernel, processes, messaging facilities and many more.

Lately I’ve been debugging a huge Erlang application whose architecture I was not very familiar with and I needed to find a way to see what kind of messages are being sent and received, which Modules and Functions are being called and what are they returning.

So I wanted to write a small How-To for me and you, in case we need it again in the future.

Okay, for this example I’ll be using Elixir TCP Server, a simple TCP server that gets data and sends it back to its origin.

First, let’s clone the repo.

antranigv@zvartnots:prj $ git clone https://github.com/SonaTigranyan/ElixirTcpServer

Okay, now let’s run the server

antranigv@zvartnots:ElixirTcpServer $ iex -S mix
Erlang/OTP 23 [erts-11.0] [source] [64-bit] [smp:8:8] [ds:8:8:10] [async-threads:1] [hipe]

Compiling 3 files (.ex)
Generated tcp_server app
Interactive Elixir (1.10.3) - press Ctrl+C to exit (type h() ENTER for help)
iex(1)>

Good! By default, the TCP server listens on port 9000, as specified in the Application Tree.

Okay, we can send data now πŸ™‚

antranigv@zvartnots:ElixirTcpServer $ echo test | nc localhost 9000
test

Or in an interactive way!

antranigv@zvartnots:ElixirTcpServer $ nc localhost 9000
First mesage!
First mesage!
Good TCP server!
Good TCP server!
bye
antranigv@zvartnots:ElixirTcpServer $

Good! As you can see the connection is closed when the server gets bye.

Okay, say we want to trace the do_send function, observe what does it get and return.

iex(2)> :dbg.start()
{:ok, #PID<0.191.0>}
iex(3)> :dbg.tracer()
{:ok, #PID<0.191.0>}
iex(4)> :dbg.tpl(TcpServer, :do_send, [{:_, [], [{:return_trace}]}])
{:ok, [{:matched, :nonode@nohost, 1}, {:saved, 1}]}
iex(5)> :dbg.p(:new_processes, :c)
{:ok, [{:matched, :nonode@nohost, 0}]}
iex(6)>
(<0.198.0>) call 'Elixir.TcpServer':do_send(#Port<0.545>,"Message from client!\n")

Okay, first we start the dbg facility, and then we start a tracing server on the local node.

After that, we use function tpl to specify which local calls we want to trace.

And in the end we use the p function to start tracing the calls (c) of all new_processes πŸ™‚

Now, when the do_send function is called, we see what it gets.

And when we send bye, we see the following:

(<0.198.0>) returned from 'Elixir.TcpServer':do_send/2 -> ok

And all of this is happening when the software system is running. In production, we can do the same, by either attaching to the node or connecting to it!

That’s all folks! πŸ™‚

Reply via email.

autofs on macOS Catalina

One of the nice things (that used to be) about macOS is how much unix is underneath, but this has been less true each year.

Like any normal human being, I do my development on a real Unix system, FreeBSD. I ended up using FreeBSD VMs that have NFS exports, and I mount those on my macOS. However, there have been issues with Catalina, here’s the main problem:

mount | grep 'map auto_nfs_antranigv'  | wc -l
18

So for some reason in Catalina you can’t do nested mounts, because auto_nfs_antranigv was mounted in /Users/antranigv/nfs, which is inside /Users (also autofs’ed) it was duplicating and ended up eating a lot of CPU πŸ™‚

Here’s the proper way of doing it

First, in /etc/auto_master add the following:

/System/Volumes/Data/netmount		auto_nfs_user

(you might want to change user to your username)

Then, create the following file β†’ /etc/auto_nfs_user

Finally you can set your mounts, for example:

someoneelsecomputer	-fstype=nfs	cloudserver:/usr/home/sysadmin/cloud

here’s a complete example:

antranigv@zvartnots:~ $ cat /etc/auto_master
#
# Automounter master map
#
+auto_master			# Use directory service
#/net				-hosts		-nobrowse,hidefromfinder,nosuid
/home				auto_home	-nobrowse,hidefromfinder
/System/Volumes/Data/nfs	auto_nfs_antranigv
/Network/Servers		-fstab
/-				-static
antranigv@zvartnots:~ $ cat /etc/auto_nfs_antranigv
illuria-dev	-fstype=nfs illuria-dev:/usr/home/antranigv/illuria
devbsd-src	-fstype=nfs devbsd00:/usr/src

Now I’m happy! πŸ™‚

Reply via email.

VNET Jail HowTo

So Dan has been tweeting that there’s no good example to get started with VNET Jails with jail.conf, I thought it’s time to write one.

In this example I’ve used FreeBSD 12.1-RELEASE

root@jail-host:~ # freebsd-version
12.1-RELEASE
root@jail-host:~ # uname -a
FreeBSD jail-host 12.1-RELEASE FreeBSD 12.1-RELEASE r354233 GENERIC  amd64
root@jail-host:~ #

First thing first, let’s setup a bridge on our host

root@jail-host:~ # sysrc cloned_interfaces="bridge0"
cloned_interfaces:  -> bridge0
root@jail-host:~ # sysrc ifconfig_bridge0="inet 10.0.0.1 netmask 0xffffff00 descr jails-bridge"
ifconfig_bridge0:  -> inet 10.0.0.1 netmask 0xffffff00 descr jails-bridge

Start the bridge0 interface without restarting the other interfaces

root@jail-host:~ # service netif start bridge0

Good! let’s setup a ZFS dataset for Jails πŸ˜‰

root@jail-host:~ # zfs create -o mountpoint=/usr/local/jails zroot/jails

Good! now let’s fetch the base.txz file. I will be using my closest mirror, you should use yours.

root@jail-host:~ # mkdir /usr/local/jails/.dist-files
root@jail-host:~ # fetch -o /usr/local/jails/.dist-files/FreeBSD-12.1-RELEASE-base.txz http://mirror.yandex.ru/freebsd/releases/amd64/12.1-RELEASE/base.txz

Perfect!

Now, we will extract the base into the jail.

root@jail-host:~ # zfs create zroot/jails/www
root@jail-host:~ # tar xf /usr/local/jails/.dist-files/FreeBSD-12.1-RELEASE-base.txz -C /usr/local/jails/www/

Nicely done! Now let’s setup our /etc/jail.conf πŸ™‚

Here’s my configuration.

# vim: set syntax=sh:
exec.stop  = "/bin/sh /etc/rc.shutdown";
exec.clean;
allow.raw_sockets;
allow.mount.tmpfs;
mount.devfs;


www {
    $id     = "10";
    $ipaddr = "10.0.0.${id}";
    $mask   = "255.255.255.0";
    $gw     = "10.0.0.1";
    vnet;
    vnet.interface = "epair${id}b";

    exec.prestart   = "ifconfig epair${id} create up";
    exec.prestart  += "ifconfig epair${id}a up descr vnet-${name}";
    exec.prestart  += "ifconfig bridge0 addm epair${id}a up";

    exec.start      = "/sbin/ifconfig lo0 127.0.0.1 up";
    exec.start     += "/sbin/ifconfig epair${id}b ${ipaddr} netmask ${mask} up";
    exec.start     += "/sbin/route add default ${gw}";
    exec.start     += "/bin/sh /etc/rc";

    exec.prestop    = "ifconfig epair${id}b -vnet ${name}";

    exec.poststop   = "ifconfig bridge0 deletem epair${id}a";
    exec.poststop  += "ifconfig epair${id}a destroy";

    host.hostname = "${name}.jail-host";
    path = "/usr/local/jails/${name}";
    exec.consolelog = "/var/log/jail-${name}.log";
    persist;
}

Now let’s start our Jail!

root@jail-host:~ # service jail enable
jail enabled in /etc/rc.conf
root@jail-host:~ # service jail start www
Starting jails: www.
root@jail-host:~ # jls
   JID  IP Address      Hostname                      Path
     1                  www.jail-host                 /usr/local/jails/www

Let’s check the networking πŸ™‚

root@jail-host:~ # ping -c 1 10.0.0.10
PING 10.0.0.10 (10.0.0.10): 56 data bytes
64 bytes from 10.0.0.10: icmp_seq=0 ttl=64 time=0.164 ms

--- 10.0.0.10 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 0.164/0.164/0.164/0.000 ms

We can do the same from the jail.

root@jail-host:~ # jexec www
root@www:/ # ping -c 1 10.0.0.1
PING 10.0.0.1 (10.0.0.1): 56 data bytes
64 bytes from 10.0.0.1: icmp_seq=0 ttl=64 time=0.087 ms

--- 10.0.0.1 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 0.087/0.087/0.087/0.000 ms

We can also stop all the jails.

root@jail-host:~ # service jail stop
Stopping jails: www.

Okay! Couple of notes πŸ™‚

You can have jail.conf at /etc/jail.conf or /etc/something.jail.conf. The problem with the latter is that if you have jail_enable="YES" in rc.conf without defining jail_list then it will run only the jails in /etc/jail.conf

There are more ways to configure VNET Jails, either with jib or jng, an example is here.

Ideally, it would be nice to have /etc/jail.d/myjail.conf, and I wrote a patch for that (D24570), if you are a FreeBSD developer, please have a look πŸ™‚

Reply via email.