Editing FreeBSD Reference (section)

= jail in FreeBSD = 

Every FreeBSD vps is a jail.  A jail is an artificial set of attributes added to a set of processes that bind them together and separate them from other processes on the system.

Do not be confused - there is no virtualization or virtual machine going on here '''at all'''.  As far as the base FreeBSD system is concerned, it is simply running a whole bunch of processes.  There is almost zero overhead in creating a jail around a set of processes.  That is to say, if there are 10 jails that each have 10 httpd processes in them, the performance will be almost exactly the same as if there were just a single FreeBSD system running 100 httpds.

You can, however, tell from the output of <tt>ps auxw</tt> which processes are in a jail and which processes are not.  All processes that are inside of a jail have a 'J' in the STAT column of <tt>ps auxw</tt>.  Now, on a production jail server, the underlying system is only running about 20 processes - things like sshd, crond, and syslog.  So on a fully loaded jail system with 900 or more processes, only 20 or so would '''not''' have a 'J' in the STAT column.

The reason it is nice to know which processes belong to the underlying server, which you can see by running:

 ps auxwJ
(we’ve patched ps on some older 4.x servers)
or
 ps auxw | grep -v J

Is that you can HUP your own sshd or restart cron on the base system - since you know that if it doesn't have a J, it is the process that belongs to the base system.  (there may be 30 more syslog processes on the system as a whole, so if it weren't for this, it would be hard to differentiate yours from all the others).

However, the J only tells you that the process is in a jail - not which jail it is in.  To tell what jail a process belongs to, you need to find its PID (in top or <tt>ps auxw</tt>) and then run:

 jpid <pid>
or
 cat /proc/<pid>/status


Here is an example:

<pre>jail1# jpid 4137
java 4137 1 3959 0 5,9 noflags 1103567686,299476 14192,584098 77838,429671 nochan 2530 2530 10005,10
005,10005 www.transelemnt.net</pre>

(If you need to fnd a proc, <tt>ps wp <pid></tt> will find the path to the executable)

As you can see, the last field in that single line of output is <tt>www.transelement.net</tt> –  so that is what system that process belongs to.
You could then:

 g www.transelement.net
or
 grep “www.transelement.net” /usr/local/jail/rc.d/?????

and you would get:

<pre>/usr/local/jail/rc.d/quad1:jail /mnt/data1/69.55.239.59-col00145-DIR www.transelement.net 69.55.239.59 /bin/sh /etc/rc
/usr/local/jail/rc.d/safe1:jail /mnt/data1/69.55.239.59-col00145-DIR www.transelement.net 69.55.239.59 /bin/sh /etc/rc</pre>
and you would see the jail command line from both quad1 and safe1 – you would then know the customer number as well, which is col00145.

So, let's take a look at how a system is started.  The jail command line consists of the `jail` command and _four_ arguments:

 jail (target_directory) hostname IP (command)

So, in the case of www.transelement.net, we see that the target directory is:

 /mnt/data1/69.55.239.59-col00145-DIR

the hostname is:  <tt>www.transelement.net</tt>, the IP is <tt>69.55.239.59</tt>

and the command is:  <tt>/bin/sh /etc/rc</tt>

Now, that may look like two commands, but it is not - we are interpreting the shell script <tt>/etc/rc</tt> with <tt>/bin/sh</tt> - much in the same way that you might run:

 perl script.pl

It is important to note that when you see the command:

 /bin/sh /etc/rc

that the <tt>/bin/sh</tt> '''and''' the <tt>/etc/rc</tt> are both inside the target system – so the jail command will fail, and the system will not start if that person does not have <tt>/bin/sh</tt> or <tt>/etc/rc</tt>.  The actual <tt>/bin/sh</tt> and <tt>/etc/rc</tt> on the '''underlying system''' are of no use.