Re: automatic creation of a chroot environment

--000000000000c48adf0656ba2582
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

---> This isn't better than Jails, it's a bit different.

I would call it a light jail. Do you like it ?

On Thu, Jul 16, 2026 at 2:46=E2=80=AFPM Rozhuk Ivan <[email protected]> w=
rote:

> On Thu, 16 Jul 2026 09:09:01 +0200
> vermaden <[email protected]> wrote:
>
> > > I've been using chroot for a long time to reduce
> > > the risk of web application hacking on my server.
> > >
> > > https://github.com/rozhuk-im/chroot_env
> >
> > Thank You for sharing, I will add this to next VN.
> >
> > Two questions out of curiosity ...
> >
> > 1. How is that better then 'Service Jails'?
> >
> > 2. How is that better then 'Single Process Jails'?
> >
> >
> https://vermaden.wordpress.com/2023/06/28/freebsd-jails-containers/#singl=
e-process-jails
> >
>
> This isn't better than Jails, it's a bit different.
>
> As a solution, the script doesn't rely on jails or zfs, but instead uses
> tmpfs and chroot. There's no network stack or OS kernel isolation.
> This solution can be used to run a browser on a workstation, so even if
> someone were able to download and run the code automatically, it likely
> wouldn't launch (due to noexec and nosuid). And if it did launch, there's
> nothing valuable in the isolated environment.
>
> The general idea is that if an application is hacked, there's no way to
> write files, and nothing can be run where files can be written. Even if
> it's possible to run something from the existing environment, almost
> nothing is available. Only the application's own data for reading and
> writing, and temporary files, are accessible.
> At the same time, the overhead of maintaining the solution is minimal: in
> my setup, it's enough to update ports and restart services; the script wi=
ll
> automatically recreate the chroot with all the files needed for launching=
.
>
> Currently, everything is stored in tmpfs, but this can easily be changed
> to geom md + UFS2 image.
> In chroot, almost everything is mounted in RO, unlike in jails, where
> everything looks like a regular installation.
>
> You can adapt this script for your own purposes to create an environment
> with all dependencies.
> In your blog, you used /rescue/sh. The examples include examples/sh - the
> script will automatically copy everything needed to /bin/sh.
>
>
>
> PS: I wanted to rework portmaster/ports make so that it would build
> packages like poudriere in a clean environment, but without requiring zfs
> and complex management.
>
>

--=20
Mario.

--000000000000c48adf0656ba2582
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div><span class=3D"gmail-im">---&gt;=C2=A0</span>This isn=
&#39;t better than Jails, it&#39;s a bit different.</div><div><br></div><di=
v>I would call it a light jail. Do you like it ?</div></div><br><div class=
=3D"gmail_quote gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr=
">On Thu, Jul 16, 2026 at 2:46=E2=80=AFPM Rozhuk Ivan &lt;<a href=3D"mailto=
:[email protected]">[email protected]</a>&gt; wrote:<br></div><blockquo=
te class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px =
solid rgb(204,204,204);padding-left:1ex">On Thu, 16 Jul 2026 09:09:01 +0200=
<br>
vermaden &lt;<a href=3D"mailto:[email protected]" target=3D"_blank">verma=
[email protected]</a>&gt; wrote:<br>
<br>
&gt; &gt; I&#39;ve been using chroot for a long time to reduce<br>
&gt; &gt; the risk of web application hacking on my server.<br>
&gt; &gt;<br>
&gt; &gt; <a href=3D"https://github.com/rozhuk-im/chroot_env" rel=3D"norefe=
rrer" target=3D"_blank">https://github.com/rozhuk-im/chroot_env</a>=C2=A0 <=
br>
&gt; <br>
&gt; Thank You for sharing, I will add this to next VN.<br>
&gt; <br>
&gt; Two questions out of curiosity ...<br>
&gt; <br>
&gt; 1. How is that better then &#39;Service Jails&#39;?<br>
&gt; <br>
&gt; 2. How is that better then &#39;Single Process Jails&#39;?<br>
&gt; <br>
&gt; <a href=3D"https://vermaden.wordpress.com/2023/06/28/freebsd-jails-con=
tainers/#single-process-jails" rel=3D"noreferrer" target=3D"_blank">https:/=
/vermaden.wordpress.com/2023/06/28/freebsd-jails-containers/#single-process=
-jails</a><br>
&gt; <br>
<br>
This isn&#39;t better than Jails, it&#39;s a bit different.<br>
<br>
As a solution, the script doesn&#39;t rely on jails or zfs, but instead use=
s tmpfs and chroot. There&#39;s no network stack or OS kernel isolation.<br=
>
This solution can be used to run a browser on a workstation, so even if som=
eone were able to download and run the code automatically, it likely wouldn=
&#39;t launch (due to noexec and nosuid). And if it did launch, there&#39;s=
 nothing valuable in the isolated environment.<br>
<br>
The general idea is that if an application is hacked, there&#39;s no way to=
 write files, and nothing can be run where files can be written. Even if it=
&#39;s possible to run something from the existing environment, almost noth=
ing is available. Only the application&#39;s own data for reading and writi=
ng, and temporary files, are accessible.<br>
At the same time, the overhead of maintaining the solution is minimal: in m=
y setup, it&#39;s enough to update ports and restart services; the script w=
ill automatically recreate the chroot with all the files needed for launchi=
ng.<br>
<br>
Currently, everything is stored in tmpfs, but this can easily be changed to=
 geom md + UFS2 image.<br>
In chroot, almost everything is mounted in RO, unlike in jails, where every=
thing looks like a regular installation.<br>
<br>
You can adapt this script for your own purposes to create an environment wi=
th all dependencies.<br>
In your blog, you used /rescue/sh. The examples include examples/sh - the s=
cript will automatically copy everything needed to /bin/sh.<br>
<br>
<br>
<br>
PS: I wanted to rework portmaster/ports make so that it would build package=
s like poudriere in a clean environment, but without requiring zfs and comp=
lex management.<br>
<br>
</blockquote></div><div><br clear=3D"all"></div><br><span class=3D"gmail_si=
gnature_prefix">-- </span><br><div dir=3D"ltr" class=3D"gmail_signature">Ma=
rio.<br></div>

--000000000000c48adf0656ba2582--