Re: automatic creation of a chroot environment

On Thu, 16 Jul 2026 09:09:01 +0200
vermaden <[email protected]> wrote:

> > I've been using chroot for a long time to reduce
> > the risk of web application hacking on my server.
> >
> > https://github.com/rozhuk-im/chroot_env  
> 
> Thank You for sharing, I will add this to next VN.
> 
> Two questions out of curiosity ...
> 
> 1. How is that better then 'Service Jails'?
> 
> 2. How is that better then 'Single Process Jails'?
> 
> https://vermaden.wordpress.com/2023/06/28/freebsd-jails-containers/#single-process-jails
> 

This isn't better than Jails, it's a bit different.

As a solution, the script doesn't rely on jails or zfs, but instead uses tmpfs and chroot. There's no network stack or OS kernel isolation.
This solution can be used to run a browser on a workstation, so even if someone were able to download and run the code automatically, it likely wouldn't launch (due to noexec and nosuid). And if it did launch, there's nothing valuable in the isolated environment.

The general idea is that if an application is hacked, there's no way to write files, and nothing can be run where files can be written. Even if it's possible to run something from the existing environment, almost nothing is available. Only the application's own data for reading and writing, and temporary files, are accessible.
At the same time, the overhead of maintaining the solution is minimal: in my setup, it's enough to update ports and restart services; the script will automatically recreate the chroot with all the files needed for launching.

Currently, everything is stored in tmpfs, but this can easily be changed to geom md + UFS2 image.
In chroot, almost everything is mounted in RO, unlike in jails, where everything looks like a regular installation.

You can adapt this script for your own purposes to create an environment with all dependencies.
In your blog, you used /rescue/sh. The examples include examples/sh - the script will automatically copy everything needed to /bin/sh.



PS: I wanted to rework portmaster/ports make so that it would build packages like poudriere in a clean environment, but without requiring zfs and complex management.