-
Notifications
You must be signed in to change notification settings - Fork 0
/
jail.conf
58 lines (49 loc) · 1.96 KB
/
jail.conf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
host.hostname="$name"; #each of my jail has its own hostname as its name below, like; nginxsrv {}
path="/jails/$name"; #my jails are located in /jails/
exec.consolelog = "/var/log/jails/$name.console.log"; #each jail has its own console log file within /var/log/jails (create that directory)
mount.fstab = "/usr/local/etc/jails/fstab.$name"; #each jail has its own fstab file (create the mentioned directory)
persist; #keep the jails running even if they have no process actively running
exec.timeout=30;
stop.timeout=30;
exec.created="logger Jail $name has started!";
exec.poststop="logger Jail $name has stopped!";
exec.start = "/bin/sh /etc/rc";
exec.stop = "/bin/sh /etc/rc.shutdown";
exec.clean;
exec.system_user = "root";
exec.jail_user = "root";
mount.devfs;
devfs_ruleset="4";
mount.fdescfs; #that's for bash shell
allow.chflags;
allow.mount;
allow.mount.tmpfs;
allow.reserved_ports; #The jails root may bind to ports lower than 1024.
allow.set_hostname="1";
allow.raw_sockets; #allow ping-pong
allow.socket_af;
enforce_statfs=1;
#mount.procfs;
#allow.mount.nullfs; # we don't need allow.mount.nullfs to mount_nullfs via mount.fstab
#allow.mount.zfs; # only needed if we use ZFS mounts - we don't need this *unless* this is our poudriere jail
#allow.read_msgbuf; # allow reading host's dmesg outputs within the jails - use it only if it's truly needed
#allow.sysvipc; #PostgreSQL needs this (needs access to shared memory), but a better solution:
# A process within the jail has access to System V IPC primitives.
# This is deprecated in favor of the per-mod-ule parameters.
# When this parameter is set, it's equivalent to setting sysvmsg, sysvsem, and sysvshm all to "inherit" which might be dangerous.
# So, setting sysv* = new is much better.
sysvmsg=new;
sysvsem=new;
sysvshm=new;
nginxsrv {
ip4.addr = lo1|10.10.10.2;
jid = 1;
}
phpserver {
ip4.addr = lo1|10.10.10.3;
jid = 2;
}
sqlserver {
ip4.addr = lo1|10.10.10.4;
jid = 3;
}