$RodHat_

Topic · 16 articles

FreeBSD & OpenBSD

Rod runs FreeBSD, and has no plans to apologise for it. A fair amount of what Linux announced as new in the last decade, one of the BSDs had already shipped, documented, and stopped talking about: jails, boot environments you can roll back with one command, a firewall with a grammar a human can read, and a sandbox that's two syscalls long.

Start with the pieces that change how you run a box day to day: jails on ZFS, bectl before every upgrade, pf that maintains its own ban list. Then dtrace and the OpenBSD sandbox. The MOTD entries track the releases and advisories worth actually reading.

Start here

Read these first, in this order.

  1. 01

    Tip · 2026-07-23

    ZFS boot environments + jails will do 90% of what you're using Docker for, and the other 10% is the part you don't actually need

    A real walkthrough of FreeBSD jails on ZFS datasets as a lighter, more honest isolation model than a container runtime for a lot of workloads.

  2. 02

    Tip · 2026-08-07

    Upgrade like you can undo it, because with bectl you can

    A ZFS boot environment is a bootable clone of your root dataset. Make one before every upgrade and a wrecked kernel becomes a reboot, not a recovery-media evening. The bectl walk, and the loader trick that saves you when the new one won't boot.

  3. 03

    Tip · 2026-08-06

    Let pf keep the ban list so you don't have to

    pf tables and anchors turn a static ruleset into a firewall that bans its own attackers and updates without a reload. Real pfctl commands, real persistence, real expiry, not a cron job that greps auth.log like it's 2004.

  4. 04

    Tip · 2026-07-20

    Find out which syscall is actually eating your latency with one dtrace one-liner

    A real dtrace/bpftrace one-liner for finding the syscall responsible for tail latency, plus why strace -T won't get you there.

  5. 05

    Tip · 2026-09-13

    pledge(2) and unveil(2): what OpenBSD figured out that Linux is still catching up to

    OpenBSD shipped two syscalls in 2016 and 2018 that let any unprivileged daemon sandbox itself down to exactly the filesystem paths and syscall categories it needs. Linux got there eventually, with seccomp-bpf in 2012, Landlock in 2021, and namespaces throughout. Compare and decide which one you'd rather write.

The syscalls underneath

Version introduced, sourced from the man page. Full cards in the syscall reference, or check your kernel.

InterfaceSinceWhat it does
jail(2)FreeBSD 4.0Create a FreeBSD jail and lock the current process into it (jail_set/jail_attach for more).
pledge(2)OpenBSD 5.9Restrict the process to named groups of system operations; violations kill it with SIGABRT.
unveil(2)OpenBSD 6.4Hide the whole filesystem except the paths you name, with per-path r/w/x/c permissions.

More console tips (2)

MOTD (9)

Other topics