Warning: there may be occasional oddness due to css and blog edits. **Active remodel of blog posts - mostly starting with most recent** 70/86
Showing posts with label jails. Show all posts
Showing posts with label jails. Show all posts

Thursday, October 8, 2026

Sylve for clean jailed build

My previous description of using sylve for porting software to FreeBSD did not include two features that I have decided to enable, but which also cause me some little bit of grief because the most simple method around it seems to no longer exist.  I setup sylve which was easy, then I configured a jail, and I have used the jail for updating a number of ports since.  I may use it to create new unofficial -dev ports.  What I did not do, was begin from nothing for the start of any port.  What I have been doing lately is just that, begin with an empty jail with the bare minimum required for any port to build from a Makefile, and then reset the jail after.

Sylve has the functionality already integral to the system.  We need to create a ZFS snapshot after the minimal configured jail with minimal required ports are installed.  After the snapshot exists, we can rollback any time at will and also configure sylve to automatically rollback when the jail is stopped.  All of this is easy from within sylve.  The other parts of the jail configuration include some allowed options for the jail, and the fstab entries to allow access to my home directory where my git directories are, and one for ports so I can avoid duplication as well as for consistency between jail builds and builds outside of it.

We need to go to the jail options tab to make some adjustments.  Each item expands by clicking the property name, then going to the top to click the edit button.

OPTIONS
Property
Value
/etc/resolv.conf
—
Additional Options
—
Allowed Options
allow.set_hostname Mount devfs Mount nullfs Raw sockets Reserved ports Set hostname Socket address families Super User privileges SysV IPC
DevFS Ruleset
—
Execution Timeout
120 seconds
FSTab Entries
/home/tigersharke /zroot/sylve/jails/200/home/tigersharke nullfs rw 0 0 /usr/ports /zroot/sylve/jails/200/usr/ports nullfs rw 0 0
Lifecycle Hooks
        Pre-start
no-tick
        Start
ticked
/bin/sh /etc/rc
        Post-start
no-tick
        Pre-stop
no-tick
        Stop
ticked
/bin/sh /etc/rc.shutdown
        Post-stop
ticked
zfs rollback zroot/sylve/jails/200@sjs_fresh-start_1789000233518
Metadata
—
Start At Boot / Start Order  
No / 0
Wake on LAN
No

The snapshot needs to be made but after it exists, clicking on the snapshot line copies the name for it.  The whole path starts with the zfs pool name and the default path of sylve/jails and the id number for the jail followed by an @ and then the snapshot name you copied.

I have all of my -dev repo directories in my home directory organized using the same directory hierarchy as the ports tree (which is important).  In my /etc/make.conf are the necessary lines including one to setup the overlay, this needs to be created inside the jail as well as outside.  For example, my luanti-dev directory path is /home/tigersharke/GitRepos/PortsTree/games/luanti-dev.

/etc/make.confDEVELOPER="YES" DEFAULT_VERSIONS+=ssl=openssl WITH_CCACHE_BUILD="YES" OVERLAYS=/home/tigersharke/GitRepos/PortsTree/

Since we are starting from nothing but the most mandatory initial programs and configuration, any build from that first Makefile (such as for one of my unofficial -dev ports) will potentially cause a build and install of as many as 1400 other ports.  Once upon a time, there was an environment variable that pkg honored which would tell it to install all dependencies as packages rather than build from source via ports.  This functionality is no longer available when building directly from a Makefile in the ports tree.  The good news, as slight as it may be, is that there is still a method to get close to the same result.  I wrote a script for each step of the process.

The first script starts with make build-depends-list run-depends-list which we can pipe to sort to alphabetize and remove duplicates, then pipe to sed and awk to exclude the initial base ports and to remove /usr/ports/ from each line as well, and finally direct it to an output file.

#!/bin/sh
# First Dependencies
make build-depends-list run-depends-list | sort -u -d | sed -e 's:/usr/ports/::' -e 's:devel/bsddialog::' -e 's:devel/ccache::' -e 's:devel/desktop-file-utils::' -e 's:ports-mgmt/pkg::' -e 's:ports-mgmt/portconfig::' | sed '/^$/d' > first_deps_list

Another script takes a file name as input to send to pkg so the content of the file is installed.

#!/bin/sh
# Prep
yes|pkg install `cat $1`

The third script uses pkg origin output which is also similarly organized and cleaned up for an output file with a larger list.

#!/bin/sh
# Most dependencies
PORTNAME=`make -V PORTNAME`
SELF=`pkg origin | grep $PORTNAME`
pkg origin | sort -u -d | sed -e 's:devel/bsddialog::' -e 's:devel/ccache::' -e 's:devel/desktop-file-utils::' -e 's:ports-mgmt/pkg::' -e 's:ports-mgmt/portconfig::' | awk -vLine="$SELF" '!index($0,Line)' | sed '/^$/d' > most_deps_list

This whole process mostly works well, except that when there are conflicting pkgs installed, such as llvm-lite and llvm, or git-tiny and git, especially when an automatic removal of one of the lesser used dependencies causes something like sdl3 to also be removed.  Not a problem but note when trying to build and install the updated or nascent unofficial -dev port, whether it still wishes to build dependencies.  At that point we can leave and allow it to chug away while we are not present, or just cancel the process to install it from pkg, and then clean and resume the install until the next ones if there are any.

The other method if those scripts are not used, is to set the build process going, re-starting it when it unexpectedly fails to get a dependency of a dependency somewhere (which truly should never occur) and then once it is entirely complete, use pkg to get a list of what was installed.  We can stop the build when we notice an extra long compile such as for llvm or any other thing, use pkg for that, clean up and restart the install.  After the build is done, we use pkg origin piped to sort and direct into an organized file, then remove the five mandatory initial ports: devel/bsddialog, devel/ccache, devel/desktop-file-utils, ports-mgmt/pkg, and ports-mgmt/portconfig.  Another two are useful to have for Makefile testing and cleanup: ports-mgmt/portfmt for portclippy, and ports-mgmt/porttools for portlint.  Portclippy has a way of helping visualize how to organize your Makefile, portlint tests various things needed for a proper FreeBSD port.

Any of the secondary lists will likely be larger than a preferred group of dependencies because it is best (for testing and development) to accept the one-size-fits-most default configurations of each and not the most lean build of any or all ports.  This is important because most users will use those defaults rather than a longer process of building customized ports locally.  When the Makefile for the resulting port is used, we can choose other options that may reduce or change dependencies from those defaults.  For testing, any options that affect what is installed should be ticked, any options that are unproven or may change upstream should also be tested, ticked.  My own system denies wayland, so I already have a few things I must build for myself due to a wayland default in the official FreeBSD pkg repo.

Regardless of whether we use the speedier or slower method initially, I believe it is best to do another pkg origin directed into a file for the final actual dependency list, minus those five ports of course.  Those mandatory ports are in the snapshot and so they will always remain after a rollback.  We are making this all-origins file so that each time in the future when we update the -dev port from an effectively empty jail, hopefully we will not need to spend any extra time to build the dependencies.  I could keep a jail for every port and leave those dependencies intact, but only up to the point that upstream changes them.  By keeping these lists and re-populating the jail before a build, its a happy medium without taking too much time after its setup.

It seems that no matter how much care is taken when compiling the list of dependencies for speedy easy install by pkg, there is a chance that weird conflicts among all of the dependencies may occur.  When this happens, automatically accepting by -y or piped yes, may also cause some dependencies to be removed just as quickly.  Instead of wasting effort on that, just get the best list of dependencies as possible, use pkg to install them, and then continue with the fresh build of the port.  I don't know how to manipulate pkg to get a better result or to ignore its sat solver.  I also don't know whatever it would take to truly re-implement that lost capability to install all dependencies with pkg instead of building any that exist in ports.

The main reason we want to test ports, or attempt to port new software, or update ports from within a clean jail, is that dependencies are not silently satisfied and therefore missed in the Makefile.  Another reason is that your main system also remains more clean and "uncorrupted" by all of the excess packages or ports that get installed to satisfy dependencies, or that are installed in hopes of satisfying dependencies.  Inside the jail we can set it up to be much more vanilla than our personal preference outside of it.  And one more good reason, is if we use what is built within the jail which means it is also installed outside of the jail, the update to a port or any testing done in the jail will not cause the executable such as a game, from being uninstalled or broken outside of the jail.  A jail can also be setup to be less vanilla but also distinct from the system outside of it, and again, means that system outside is unaffected.

Use sylve to very easily manage a dozen different jails, or just one.  Sylve makes the management accessible and visible, all of the options are present, it allows a fresh clean jail on demand, even if it is the same one you always use for a purpose.  Working from within a web browser for the interaction may change some things a little bit but those are easily understood.  I get around some of the differences by being able to work with git in the same directory from outside of the jail, but I think its the browser that is getting in the way rather than a quirk with sylve.  The more sylve is used, the greater chance for improvement, but it is still a great tool in its relatively early days.

Friday, July 10, 2026

jail porting with sylve

Once before, in the now distant past I had used a spiffy GUIfied tool to handle jails on my FreeBSD system.  This was Warden on PC-BSD.  It was super helpful and easy to use.  Since then I have tried numerous different tools including bastille.  Of those, only bastille worked for me and was easy enough to use.  Unfortunately I never got accustomed to using it, not having used it enough.  I recently played with sylve as a tool for handling Virtual Machines in bhyve, and since it also has a jail function I have decided to test this out too.

My recent perceived finished Mudlet port seems to have developed a pile of flaws after I erased everything installed on my system when not long ago I had graphics issues.  It is because of this that I am going back to using jails for my periodic port updates if possible, and definitely when I do the initial porting.  This will ensure the option of a clean system with nothing else installed, so that I can start from zero without suffering the lack of things installed on my host system.

sylve jail setup

The setup seems very simple, there is a basic guide on the sylve site that helps to inform the user what each setting is about.  I followed it to get the initial jail setup accomplished but if I can mount my ~/GitRepos/PortsTree and possibly even use that as an overlay of the main ports tree, that would be ideal.

Click image to enlarge

When we create a jail, first from the Basic tab we choose a jail name and host name, they can be the same, and it makes sense to set 200 for the first jail ID.  From the Storage tab, we choose the host ZFS pool, and the Base we downloaded.  I could have chosen a 15.x release image "base.txz" but since there are snapshots for 15.1-stable, I chose to use that as it would be closest to what I have on my host system.  Using something nearly identical to what is on Ichigo will help me duplicate all aspects I already know, and help me find other issues that I have not yet discovered.  From the Network tab I choose Inherit, so that the jail uses the host's connectivity.  Accessing the Hardware tab lets us choose various limits, so I untick Resource limits.  I am unsure precisely what Clean Environment means, but I leave it ticked.  We also choose between Linux and FreeBSD jail type which I leave as FreeBSD because that was what I need for my purposes.  The Allowed Options dropdown includes a number of things we should tick for the jail purpose I need: Set Hostname, Raw Sockets, Mount devfs, Socket Address Families, Reserved Ports, Mount nullfs.

One thing I need to do to make use of the ports tree on the host is to null mount it within the jail.  I could set it as read-only because there are no changes I will need to make, but adding it will eliminate the need to re-create it within the jail.  The small problem is that /usr/ports/distfiles needs to be read-write, so we make the whole /usr/ports read-write.  We need to enter the jail to create the mountpoint, /usr/ports before the fstab can be successful.

Click image to enlarge

On sylve, we need to edit the fstab for the jail.  The jail I created has its name and an ID number in parenthesis, I set mine as 200 so that the ID will be distinct between VMs and Jails.  We click the jailname we gave it, underneath our hostname in the tree on the left.  Underneath the summary tab, at the bottom is options.  We click the options tab which opens a window showing property and value.  Right now there is no value for the FSTab Entries property.  We click on that line, and a new button, Edit FSTab Entries appears.  When we click on the edit button, we get an empty window with the title FSTab Entries.  Into the FSTab Entries window we type the line to add the host ports tree into the jail.

/usr/ports   /zroot/sylve/jails/200/usr/ports   nullfs   rw   0   0

Getting the nullfs mounted ports tree took me a bit of trial and error, since things are slightly different with sylve than they are for other jail managers.  I couldn't look at examples or forum posts and do the exact same thing, I had to try a couple ways to see which was successful by discovering which attempt permitted the jail to start.  Once it started I could use the console button below the summary button to verify by doing an ls of /usr/ports.

The other thing I want to do, to make things easier for myself, is to use a ports tree overlay of my ~/GitRepos/PortsTree onto the official FreeBSD ports tree.  The only time I have done this successfully was using the instructions to build xlibre the first time.  Its already been a while since I did that, but referencing the instructions at b-aaz/xlibre-ports on github, it tells me to clone that repo and enter it, then echo the pwd into the make.conf, and so to translate this to my purposes I do a little differently.

cd ~/GitRepos/PortsTree
echo "OVERLAYS=$(pwd)/" >> /etc/make.conf

This I can also do on the host in order to setup the overlay there as well.  What I am unsure about but seems likely, is that I may need to edit or remove the various directory Makefiles and the MOVED file.  Doing this in the jail will inform me about whether that is necessary.  However, to even attempt the ports overlay that I want, I will need to add two more lines to the fstab and create its mountpoint /home.

/home/tigersharke   /zroot/sylve/jails/200/home/tigersharke   nullfs   rw   0   0

One more detail that missed my recognition, we need to initialize pkg by initiating a pkg update.  Once this is done, a fetch in any of my -dev ports will succeed to register.  When I did a make config I discovered a new improvement that tripped me up some years ago.  Attempting to make config will cause bsddialog and portconfig to be installed, which otherwise would have caused the make config to fail, this was a pleasant surprise.

Working on porting

I had forgotten that I had a duplicate of yajl in the devel directory of my own PortsTree which necessarily conflicted with the official one because I didn't name it to be unique.  This didn't matter until I used my pseudo ports tree with the overlay, but now it caused unusual errors.  Easily fixed, I renamed the directory with the -dev suffix.  At the same time I renamed any extra Makefiles and the touched MOVED file with a hid- prefix.  I may not need them but I'm keeping them around for now.

When I tried to build Mudlet outside of the jail, before I set all this up, I ran into some weird errors.  It took me a while to recognize that the issue was one Mudlet dependency.  The lua-luarocks dependency is an oddity itself.  If you tick the option to use luajit instead of ordinary lua, then lua-luarocks has no flavors.  If you do not tick that option, lua-luarocks does have flavors.  This is somewhat of a concern but I am not sure how to permit either to satisfy the dependency for Mudlet.  I am going to add a note in the Makefile and use the unticked option build of lua-luarocks.

make all-depends-list | sed -e 's#^\/usr\/ports##' > all-depends
yes|pkg install `cat all-depends`

Another oddity originates from how I populated the jail.  Without anything installed, I chose to make an all-depends-list and use that to have pkg install all of those dependencies in the jail.  This greatly speeds things up but since this is an empty jail, there are more than 1000 things to install.  After all of that was installed, the build declares that I need a different port to satisfy the zip requirement, so I revised that dependency line and later, outside of the jail, it wanted to use the other zip dependency.  I decided to have both listed and let the system install whatever.  I am not sure yet if I need to have an option for whether to use zip or minizip.

The build eventually succeeded inside the jail and outside the jail, and I continued to update Mudlet for the more recent upstream commits, my own Mudlet-dev repo advancing from June 26th all the way to July 6th.

Later I adjusted the patch files with conditional wrappers and then on a whim, checked to see how many of the four patches were actually required.  What I discovered was that only one file must be patched and it needs both of the two patches within the GeyserAdjustableContainer.lua file.  I have since submitted a pull request for this patch to upstream Mudlet so that either my corrections will be applied for FreeBSD or better understanding of the issue will lead to changes which may obsolete FreeBSD specific patches for it.

After I setup git with my email and user name, I had to fix the dubious directory permission/ownership setting in git to quiet that complaint.  I had to add my github token file to my root in the jail, so I can copy and paste it, or maybe copy from outside and paste it into the console.  I also may want to eventually add any number of aliases or scripts that would make porting easier within the jail.  One thing that will be very nice is that the options for any port can be different within the jail than outside.  This means that when I rebuild luanti or mudlet for the latest commit, when I build it to use, I can leave the options set to only those that I personally need or want.  I won't need to tick and then untick for the two builds, but also there will need to be two builds because one is in the jail.  I frequently did build twice normally, so this will be a small improvement.

Sylve jail thoughts

Using sylve via librewolf is with a console screen in the browser.  This is a bit different than an xterm, the cursor is a blinking bar on the left edge of the current occupied space or character which takes a little getting used to.  Another difference is that I like to use the mouse to select and paste which is common for Unix/X but can be challenging in the sylve console.  Instead of select with one mouse button and paste with another, its select and control-v to paste.  This is functional but a little strange.  Selecting within the console can be difficult to limit to the line you desire, primarily if the line is near the bottom edge.

I had moments when sylve (or librewolf) forgot that I was typing in the console, and it took a little bit to sort of wake it up, or maybe it simply did not scroll to match what was displayed.  There is also some weirdness with how the option screen for a port configuration appears to me, a bit washed out and a kind of broken almost graph-paper appearance though all a pale blue.  I don't know why it looks like this, except that it is some kind of interpretation by either sylve or librewolf.  Its not something I could determine as able to be changed.

We can change the font size and color or background color from a gear icon in the upper right, so I chose green text on black, and size 14 font.  Closing that dialog after the change sometimes leaves it accessible, so pressing return or clicking the console could brings it back, but it is easily hidden again and doesn't appear unintentionally another time.

I figured out how to get the text in the console to have a gap between it and the bounds of the window with a little CSS but I was unable to figure out how to get the lines in the textarea to have a bit more spacing, and I have not yet checked whether I can use CSS to adjust the cursor.

.terminal-wrapper
{
    padding-left:8px;
    padding-top: 4px;
    padding-bottom: 4px;
    user-select: auto!important;
}

Sylve is definitely functional for use to setup a jail and to stop or start it, and I will be continuing to use it for that function, as well as for the virtual machine I setup previously.  I believe I can access a jail with a simple chroot into it since its localhost, so if I wanted, I could do similarly as with the VM and reach it with an ordinary xterm but with chroot instead of ssh.  Perhaps I am misremembering or it might have been a thing with Warden, so I was wrong, but it seems as though using sh is also the way to access the jail if I do not use the sylve console.

Frequently viewed this week