repository·master·Indexed 22 days ago
https://github.com/bastillebsd/bastilleAn open-source system for automating the deployment and management of containerized applications on FreeBSD using jails. Bastille supports various jail types (vnet, bridged vnet, thin, thick, empty, clone, and Linux) and provides features for automation via templates, jail cloning, custom releases, and advanced networking including IPv6 and dynamic firewalls. It is written in Bourne Shell with zero external dependencies and offers full support for ZFS and PkgBase.
While Bastille supports mixing and matching different BSD distributions, users must be aware of tool dependencies:
Users are responsible for ensuring the correct environment and tools are present when mixing distributions.
You can define dependencies between jails to ensure a specific startup and shutdown order. If jail1 depends on jail2, Bastille will verify that jail2 is running (starting it if necessary) before starting jail1.
Startup Behavior:
When starting jail1, Bastille checks its depend property. If jail2 is not running, it is started first.
Shutdown Behavior:
When stopping jail2, any jail that depends on it (e.g., jail1) will be stopped first.
Note on Restarting:
If you bastille restart jail2, any jail that depends on jail2 will be stopped, but it will not be automatically restarted, because jail2 does not depend on the dependent jail.
Example:
To make nextcloud depend on mariadb and nginx:
bastille config nextcloud set depend "mariadb nginx"Bastille containers run at securelevel = 2 by default. The securelevel determines the restrictions placed on the kernel to prevent tampering.
Security Levels:
-1 (Default initial): Permanently insecure mode.0: Insecure mode. Immutable/append-only flags can be turned off.1: Secure mode. System immutable/append-only flags cannot be turned off; kernel modules cannot be loaded/unloaded; /dev/mem and /dev/kmem cannot be opened for writing.2 (Bastille Default): Highly secure mode. Adds restrictions where disks may not be opened for writing (except by mount(2)), preventing tampering via unmounting. Time changes are also clamped to $\le 1$ second.3: Network secure mode. Adds restrictions where IP packet filter rules and dummynet/pf configurations cannot be adjusted.Note: Bastille does not automate securelevel changes. It is recommended to leave this at the default 2 and only change it manually on a case-by-case basis.
To create a valid Bastille template, you must organize your files in a directory structure where a Bastillefile is present at the root of the template path.
Required Structure:
project/template/BastillefileThe Bastillefile is where you define the template hooks (see the 'Template' documentation for supported hooks).
Bastille uses a subcommand TARGET ARGS syntax. Every command requires a target, which is typically a jail or a release.
You can target a jail using any of the following:
Note on Tags: If you use a tag as the TARGET, Bastille targets all jails with that tag. However, if a jail exists with the exact same name as the tag, Bastille will target that specific jail instead of the tag.
To target a release, provide the exact release name. Do not include the point-release version (e.g., use 13.2-RELEASE, not 13.2-RELEASE-pX).
ALL or all.# Target all running jails
bastille cmd all "sockstat -4"
# Target multiple specific jails
bastille cmd "jail1 jail2 jail3" echo Hello!
# Target a release
bastille bootstrap 13.2-RELEASEThe behavior of adding an interface depends on whether the jail is a classic jail or a VNET jail:
-V or --vnet.-B or --bridge.-v | --vlan <VLANID> switch, Bastille will add the VLAN ID to the jail as a vnetX.X interface (where X is the specified interface).-M | --static-mac to ensure a persistent MAC address.Bastille supports several networking modes depending on whether you are using standard jails or VNET jails (created with -V or --vnet).
-V): Bastille creates a bridge interface (e.g., em0bridge) and attaches the jail to it using host/jail epairs. This makes the jail appear as a physical device on your local network with its own MAC address and IP.-B): Identical to VNET, but you must manually create the bridge interface first. Bastille will then attach the host/jail epairs to your existing bridge.pf firewall table to allow outbound access. If no interface is specified, Bastille attempts to use bastille0 (created via bastille setup).ip4=inherit.jail(8) behavior.# Example: Creating a VNET jail
bastille create myjail 13.2-RELEASE -V 192.168.1.50/24 vtnet0container and jail are used interchangeably. Both terms refer specifically to a FreeBSD jail. You can treat them as synonymous when following guides or executing commands.When cloning a vnet jail that has multiple network interfaces, Bastille applies specific networking constraints to prevent IP conflicts between the original jail and the new clone:
bastille clone command.ifconfig_inet="").The RDR hook supports two modes of port redirection:
tcp hostport jailport (e.g., tcp 2200 22 forwards host port 2200 to jail port 22).[ipv4|ip46|dual] interface source-ip dest-ip proto hostport jailport.Example of Advanced RDR:
RDR ipv4 vtnet0 192.168.0.1 any tcp 2022 22
This forwards port 22 in the jail to port 2022 on the host, but only for connections originating from 192.168.0.1 on interface vtnet0.
RDR ipv4 vtnet0 192.168.0.1 any tcp 2022 22Bastille supports several jail types depending on how they interact with the bootstrapped release:
--thick or -T): These copy the entire release into the jail, making the jail a completely independent, full BSD install.--clone or -C): Clones of the bootstrapped release. Note that changes to the release will affect these jails.--empty or -E): Creates a completely empty jail. Use with caution.--linux or -L): Jails that run Linux instead of BSD.When configuring default interfaces for jails (used when the interface is not explicitly provided during the create command), you must choose between loopback and shared networking.
Key Constraints:
loopback and shared interfaces. Configuring one will disable the other.bastille0 loopback interface (lo) that jails link to. It is the simplest networking option and is not attached to a specific physical interface.create command, these setup options (loopback or shared) have no effect; the specified interface will be used instead.