GSP
Quick Navigator

Search Site

Unix VPS
A - Starter
B - Basic
C - Preferred
D - Commercial
MPS - Dedicated
Previous VPSs
* Sign Up! *

Support
Contact Us
Online Help
Handbooks
Domain Status
Man Pages

FAQ
Virtual Servers
Pricing
Billing
Technical

Network
Facilities
Connectivity
Topology Map

Miscellaneous
Server Agreement
Year 2038
Credits
 

USA Flag

 

 

Man Pages
APPJAIL-QUICK(1) FreeBSD General Commands Manual APPJAIL-QUICK(1)

appjail-quickCreate a pre-configured jail

appjail quick name [options ...]

The appjail quick utility creates and configures a jail. Basically, it configure the template that the jail uses with options that you specify after its name. Each option has its own responsibility, but in a nutshell, it writes the template with other AppJail subcommands. Due to this flexibility, appjail quick provides a simple and fast approach to creating and recreating jails. The appjail-makejail(1)'s -o parameter and the appjail-makejail(5)'s instruction are essentially a wrapper for this command.

Each parameter has a data type, can conflict with other options, can be specified multiple times, and can even have dependencies, that is, it needs another parameter to work correctly or even to take effect.

String
Any character that is valid according to the option itself is valid.
Integer
Positive number, or in other words, .
Boolean
An option with no arguments is considered to be of type boolean.
Options
A parameter that contains subparameters.

| ="interface"

Interface assigned to the jail. interface is used as the default interface for other options specified in Requires; If not defined, each option must define the interface to use, but is not a requirement. It is recommended to configure an interface using this option or at least one for each option listed in Requires, as the jail(8) framework may not perform any action.

Type: String
Multiple: No
Conflicts (any):


Requires (any): Examples:

Set the boot flag to the jail, so that appjail-startup(1) can start it, typically at startup.

See also appjail-jail(1).

Type: Boolean
Multiple: No

="[type:]interface ... [bridge:bridge]"

Create a bridge if it does not exist and attach one or more interfaces.

See also appjail-network(1).

Type: Options
Parameters:

  • type: Interface type. Can be either epair or iface. If epair is used, two if_epair(4) interfaces, interface that should be used by the host, and interface that should be used by the jail, are created. If iface is used, an existing interface will be added as a member of bridge.

    Note that the MTU is obtained from the first interface (regardless of type) you specify, but you should first specify the iface type first, so that the bridge and other interfaces use the same MTU, a requirement of the if_bridge(4) driver. If an epair type is specified first, then the MTU specified by the parameter is used. is the default.

  • : Use a different bridge than the one specified by the parameter.

Conflicts (any):
Multiple: Yes
Examples:
="jail@snapshot"

Create a new jail by cloning a ZFS snapshot of jail.

Type: Options
Parameters:

  • jail: Jail to create a ZFS snapshot for cloning.
  • snapshot: ZFS snapshot name.
Conflicts (any): Multiple: No
Examples:
="snapshot"

Create a new jail by cloning a ZFS snapshot of a release.

With this option only the and thick jail types can be used.

Type: Options
Parameters:

  • snapshot: ZFS snapshot name.
Conflicts (any): Multiple: No
Examples:
="[boot] [expose] [ext_if:interface] [ext_ip:address] [args:args] [logopts[:options]] [name:name] [on_if:interface]"

Changes the behavior of the from option.

Type: Options
Parameters:

Multiple: No
Examples:
="jail"

Create a new jail by copying another existing jail.

Type: String
Conflicts (any):


Multiple: No
Examples:
="directory"

Root directory used by the file and files options. If this option is not set, the directory specified by the parameter is used.

Type: String
Multiple: No
Examples:

="cpu-list"

Configure processor sets.

See also appjail-cpuset(1).

Type: String
Multiple: No
Examples:

="parameter=value"

Set default parameters for the stage.

See also appjail-enable(1).

Type: String
Multiple: Yes
Examples:

="router"

Create a static default route to this jail.

Type: String
Multiple: No
Examples:

="router"
The IPv6 equivalent of defaultrouter.
="rulespec"

Add a DEVFS rule.

See also appjail-devfs(1).

Type: String
Multiple: Yes
Examples:

=ruleset

devfs ruleset number that is enforced for mounting devfs(5) in this jail.

We recommend using the device option to dynamically assign a devfs ruleset number.

Type:
Multiple: No
Requires (any):

Examples:
="interface"

Configure interface using DHCP.

You must unhide the device for this jail for dhclient(8) to work without problems.

Type: String
Multiple: Yes
Requires (any):

Examples:

Create an empty jail.

Type: Boolean
Multiple: No
Conflicts (any):

="hport[:jport] [descr:description] [ext_if:interface] [ext_ip:address] [logopts[:options]] [network:network] [on_if:interface] [proto:protocol]"

Perform port forwarding.

See also appjail-expose(1).

Type: Options
Parameters:

  • hport: Host or external port.

    hport can be specified using a symbolic name as described in services(5).

  • jport: Port currently listening to the application within the jail. If not set, hport is used.

    jport can be specified using a symbolic name as described in services(5).

  • : Service description.
  • : Interface to obtain the external IPv4 address. If not set, the interface specified by the EXT_IF parameter is used.
  • : Uses the specified IPv4 address instead of the first matching one. The specified IPv4 address must exist on the specified external interface.
  • : Firewall-specific logging options. Logging can be enabled without providing any arguments.
  • : Network to obtain the jail's IPv4 address. If not set, the default network defined by the default subparameter of the virtualnet option is used. If you don't specify a network using this subparameter or even none is marked as default, an error will be raised.
  • : Apply rules to packets coming in on, or going out through, this interface. If not set, the interface specified by the ON_IF parameter is used.
  • : Protocol, that is, tcp or . The default is tcp.

Multiple: Yes
Requires (any): Examples:
  • ="80"
  • ="8080:80 \"descr:NGINX service\" logopts"
="file"

File to copy to jail.

copydir affects this parameter: if copydir is /tmp/copydir-files and you specify file to be /etc/rc.conf, the real path is /tmp/copydir-files/etc/rc.conf.

This option copies file as is, that is, with metadata such as permissions, owner and group, and will even create the necessary directories before the file, e.g. if file is set to /etc/rc.conf, /etc is created before rc.conf is copied.

Type: String
Multiple: Yes
Examples:

  • ="/etc/rc.conf"
="file"

Reads file assuming each line is a file to be copied. See file for more details.

Type: String
Multiple: Yes
Examples:

="image"
Creates a jail using an OCI image. It also creates a container linked to the jail, so that if an attempt is made to destroy the jail using appjail-jail(1) destroy the container is destroyed.

This option also implicitly sets the empty option.

By default, the container name is randomly generated unless you specify one using the name suboption of the container option.

The volumes and labels specified by the OCI image are also created as AppJail volumes and labels. Since the volume name must be unique in AppJail, a bit of magic is performed: _ character will be , character will be _, the first character is removed, any character other than will be -, and the resulting string will be concatenated with the string where will be a SHA256-HASH of 10 digits created using the mount point of the volume before processing, so for example, if the volume specified by the OCI image is the resulting volume name will be .

The ports defined by this image that are to be exposed are also set, but by default they are not exposed unless the expose suboption of the container option is specified.

The jail type will always be thick regardless of the operating system, the release is the one specified by the release option or the default when none is specified, the architecture and the operating system version are also set. For the architecture a "translation" is performed: will be , will be and will be . If the operating system is freebsd, AppJail will try to get the FreeBSD version using freebsd-version(1) without the patch level, and if this fails AppJail will try to get the version using uname(1) -r without the patch level and if this fails it will use the operating system name as the operating system version. It uses uname(1) -r to get the OS version when it is not freebsd and if it fails, the OS name is used as the alternate version.

Type: String
Multiple: No
Examples:

  • ="docker.io/dtxdf007/freebsd"
="device mountpoint [type] [options] [dump] [pass]"

Creates an appjail-fstab(1)'s entry.

See also appjail-fstab(1) and fstab(5).

Type: Options
Parameters:

  • device: Describes the special device or remote file system to be mounted.
  • mountpoint: Describes the mount point for the file system.
  • type: Describes the type of the file system.
  • options: Describes the mount point options associated with the file system.
  • dump: This field is used for these file systems by the dump(8) command to determine which file systems need to be dumped.
  • pass: This field is used by the fsck(8) and quotacheck(8) programs to determine the order in which file system and quota checks are done at reboot time.
Multiple: Yes
Examples:
  • ="/tmp /tmp"
  • ="/usr/local/www /usr/local/www"
  • ="/dev/da0s1 /mnt msdosfs"
="[health_cmd:command] [interval:seconds] [kill_after:seconds] [name:name] [recover_cmd:command] [recover_kill_after:seconds] [recover_timeout:seconds] [recover_timeout_signal:signal] [recover_total:number] [retries:number] [start_period:seconds] [timeout:seconds] [timeout_signal:signal]"

Creates a healthchecker.

See also appjail-healthcheck(1) and appjail.conf(5).

Type: Options
Parameters:

  • : Command to evaluate the jail's health. Prefix command with host: to run the command from the host or with jail: to run the command from the jail.
  • : Interval to check the jail's health.
  • : Send a SIGKILL signal to the process created by health_cmd command after seconds has been reached only if it is still running.
  • : Healthchecker name.
  • : Command to heal the jail if it is considered to be failing. Prefix command with host: to run the command from the host or with jail: to run the command from the jail.
  • : Send a SIGKILL signal to the process created by recover_cmd command after seconds has been reached only if it is still running.
  • : Send the signal specified by recover_timeout_signal to the process created by recover_cmd command after seconds has been reached only if it is still running.
  • : Signal to send on timeout.
  • : The maximum number of attempts reached before the jail is considered unhealthy.
  • : Number of attempts to heal the jail when it is failing and to start the recover_cmd command.
  • : Delay before running the healthchecker.
  • : Send the signal specified by timeout_signal to the process created by health_cmd command after seconds has been reached only if it is still running.
  • : Signal to send on timeout.
Multiple: Yes
Examples:
="interface:options"

ifconfig(8) options to pass to the specified interface.

Type: Options
Parameters:

  • interface: Target interface.
  • options: ifconfig(8) options.
Multiple: Yes
Requires (any): Examples:
The IPv6 equivalent of ifconfig.
="input:file [portable] [compress:algo]"

Create a new jail by importing a tarball file into the jail directory.

Type: Options
Parameters:

  • : Tarball file.
  • : Ignored, but used by import+root.
  • : Ignored, but used by zfs+import+jail and zfs+import+root.
Multiple: No
Examples:
="input:file [portable] [compress:algo]"

Create a new jail by importing a tarball file into the root directory of the jail.

Type: Options
Parameters:

  • : Tarball file.
  • : Include only portable files. These are the jail directory, the configuration file describing the jail, the initscript and volumes. This is used by appjail-image(1).
  • : Ignored, but used by zfs+import+root and zfs+import+root.
Multiple: No
Examples:
="file"

Custom

Note that this option is meaningless in a Makejail, as the is overwritten when generating one.

See also appjail-initscript(5).

Type: String
Multiple: No
Examples:

="ip4-address" | ="interface|ip4-address"

IPv4 address assigned to the jail. The IPv4 address is assigned to the interface or to the interface specified by the alias option.

See also the alias option for more details.

See also jail(8).

Type: String
Multiple: Yes
Conflicts (any):

Requires (any):

Stop the jail from using IPv4 entirely.

Type: Boolean
Multiple: No
Conflicts (any):

Requires (any):

Allow unrestricted access to all addresses on the system.

Type: Boolean
Multiple: No
Conflicts (any):

Requires (any):
, ip6_disable, ip6_inherit

Counterpart of ip4_disable and ip4_inherit.

="name [iface:]interface ... [bridge:bridge]"

Use Netgraph with the jng script. This script will create Netgraph nodes such as ng_bridge(4) and ng_eiface(4). The bridge will be named interfacebridge and the nodes name, name ... name.

You need to install the jng script before using this option. Run ‘install -m 555 /usr/share/examples/jails/jng /usr/local/bin/jng’ to install it.

Type: Options
Parameters:

  • name: Name of links.
  • : An existing interface to use.
  • : A secondary bridge is created when the bridge name is different from bridge.

Multiple: Yes
Conflicts (any): Examples:
  • ="myjail jext"
="key[:value]"

Add a new label to the jail.

See also appjail-label(1).

="rule [descr:description]"

Add a resource limit rule to the jail.

See also appjail-limits(1).

Type: Options
Parameters:

Multiple: Yes
Examples:

Mount filesystems required by many Linux distributions to work correctly. You probably want to set the devfs_ruleset option (unless you specify the devices by option with device) to another value because LinuxJail will not work with the default value specified by the parameter. The following mount points are used: /dev, , , and .

Type: Boolean
Multiple: No
Conflicts (any):

Log in to the jail after starting it with the start option.

See also appjail-login(1).

Type: Boolean
Multiple: No
Requires (any):

="username"

Log in as username with the login option. If not specified, the user specified by the parameter is used.

Type: Boolean
Multiple: No

="interface:addr" | ="interface:random" | ="interface:static[:prefix]"

Changes the MAC address of a given interface.

Type: Options
Parameters:

  • interface: Target interface to change MAC address.
  • addr: Mac Address.

    Two special values are accepted, that is, to use a random MAC address, and static, which optionally accepts a MAC address prefix of 8 bytes in length.

    The special value static generates a MAC address using the jail name and if prefix is defined, it will be used as a prefix of the MAC address.

Multiple: Yes
Requires (any): Examples:

Mount a devfs(5) filesystem on the chrooted /dev directory, and apply the ruleset specified by devfs_ruleset option to restrict the devices visible inside the jail.

If you don't specify devfs_ruleset, but do specify the device option, appjail quick will assign a ruleset number automatically.

Type: Boolean
Multiple: No
Conflicts (any):

| ="[ext_if:interface] [ext_ip:address] [logopts[:options]] [network:network] [on_if:interface]"

Mask the jail's IPv4 address using the ext_if's interface on the on_if's interface.

Type: Options
Parameters:

  • : Interface to obtain the external IPv4 address. If not set, the interface specified by the EXT_IF parameter is used.
  • : Uses the specified IPv4 address instead of the first matching one. The specified IPv4 address must exist on the specified external interface.
  • : Firewall-specific logging options. Logging can be enabled without providing any arguments.
  • : Network to obtain the jail's IPv4 address. If not set, the default network defined by the default subparameter of the virtualnet option is used. If you don't specify a network using this subparameter or even none is marked as default, an error will be raised.
  • : Apply rules to packets coming in on, or going out through, this interface. If not set, the interface specified by the ON_IF parameter is used.
Multiple: Yes
Requires (any):
="name address [description]"

Create a new network if it does not exist.

Type: Options
Parameters:

  • name: Network name.
  • address: Network address.
  • description Description of the network.
Multiple: Yes
Examples:
  • ="dns 172.0.0.0/10 \"DNS network\""

Don't use the boot option.

Type: Boolean
Multiple: No

Don't use the mount_devfs option.

Type: Boolean
Multiple: No

| ="[ext_if:interface] [network:network] [on_if:interface]"

Don't perform NAT on the jail with the given parameters.

Type: Options
Multiple: Yes
Parameters:

  • : Interface to obtain the external IPv4 address. If not set, the interface specified by the EXT_IF parameter is used.
  • : Network to obtain the jail's IPv4 address. If not set, the default network defined by the default subparameter of the virtualnet option is used. If you don't specify a network using this subparameter or even none is marked as default, an error will be raised.
  • : Apply rules to packets coming in on, or going out through, this interface. If not set, the interface specified by the ON_IF parameter is used.

Don't use the login option.

Type: Boolean
Multiple: No

Don't use the overwrite option.

Type: Boolean
Multiple: No

Don't use the resolv_conf option.

Type: Boolean
Multiple: No

Don't use the restart option.

Type: Boolean
Multiple: No

Don't use the run option.

Type: Boolean
Multiple: No

Don't use the start option.

Type: Boolean
Multiple: No

Don't use the tzdata option.

Type: Boolean
Multiple: No

="architecture"

Specify the architecture to use in the jail. If this option is not set, the architecture specified by the parameter is used.

Type: String
Multiple: No

="version"

Specify the version of the operating system to use in the jail. If this option is not set, the version specified by the parameter is used.

Type: String
Multiple: No

| ="force|recursive|force+recursive"

Stop and destroy the jail if it exists. With force, appjail quick will forcibly unmount datasets and with recursive, appjail quick will recursively destroy all dependents, including cloned file systems outside the target hierarchy. To use both options, use force+recursive.

, and do nothing when ZFS is not enabled.

Type: String
Multiple: No

="package"

Install a package.

Type: String
Multiple: Yes

="priority"

Priority number. If this option is not set, the priority specified by the parameter is used.

See also appjail-startup(1).

Type: String
Multiple: No

="release"

Specify the release to use in the jail. If this option is not set, the release specified by the parameter is used.

See also appjail-fetch(1).

Type: String
Multiple: No

| ="file"

Copy a resolv.conf(5) file to the jail. If this option is used without arguments, the resolv.conf(5) file specified by the parameter is used.

Type: String
Multiple: No

Restart the jail after starting it with the start option.

Type: Boolean
Multiple: No

Run the cmd stage after starting the jail with the start option.

Type: Boolean
Multiple: No

="parameter=value"

Set default parameters for the cmd stage.

See also appjail-enable(1).

Type: String
Multiple: Yes

="name=value"

Set default environment variables for the cmd stage.

See also appjail-enable(1).

Type: String
Multiple: Yes

="interface"
Configure interface using SLAAC.
Type: String
Multiple: Yes
Requires (any): Examples:

Start the jail after its creation.

Type: Boolean
Multiple: No

="parameter=value"

Set default parameters for the start stage.

See also appjail-enable(1).

Type: String
Multiple: Yes

="name=value"

Set default environment variables for the start stage.

See also appjail-enable(1).

Type: String
Multiple: Yes

="parameter=value"

Set default parameters for the stop stage.

See also appjail-enable(1).

Type: String
Multiple: Yes

="name=value"

Set default environment variables for the stop stage.

See also appjail-enable(1).

Type: String
Multiple: Yes

="template"

Template file. If not specified, the template file specified by the parameter is used.

Type: String
Multiple: No

="file"

Create a new jail by importing a TinyJail.

Type: String
Multiple: No
Conflicts (any):

Create a directory and an appjail-fstab(5)'s entry to mount /tmp within the jail. The directory is created with permissions ‘1777’.

Type: Boolean
Multiple: No
Conflicts (any):

Type on which the jail is based. The default is .

See also appjail-jail(1).

Type: String
Multiple: No
Examples:

| ="zoneinfo-name"

Copy a tzfile(5) file to the jail. If this option is used without arguments, /etc/localtime is used. If set, a symlink is created inside the jail as /etc/localtime. If this option is not set, the tzfile(5) specified by the parameter is used.

Type: String
Multiple: No
Examples:

="[network]:interface [default] [address:ipv4-address] [interface_desc:description]"

Create a bridge called network and attach interface to it. Additionally, assign an IPv4 address from the network address pool.

Type: Options
Parameters:

  • network: Network to use.

    If specified, network must exist previously created using the network option or using the appjail-network(1) command. If not set, appjail quick will create a network using parameters such as , , and . We recommend leaving this responsibility to appjail quick to automatically create the network, but check if the AUTO_* parameters are okay for your environment and change them if necessary.

  • interface: if_epair(4) interface to create.

    There are two special names for the interface name, <name>, to use the jail name, and <random> to use a random hexadecimal string. We recommend <random> instead of <name> as the latter can cause problems when the jail name and interface name are incompatible.

  • : Mark this network as default, so options like expose and nat can use it without explicitly specifying it.
  • : Static IPv4 address that must be valid for network. If not set, an address is assigned automatically.
  • : Interface description.
Multiple: Yes
Examples:
="interface"

A network interface to give to a vnet-enabled jail after is it created. The interface will automatically be released when the jail is removed.

Type: String
Multiple: Yes
Conflicts (any):

="volume [group:gid] [mountpoint:mountpoint] [owner:uid] [perm:mode] [type:type]"

Create a new volume.

See also appjail-volume(1).

Type: Options
Parameters:

  • volume: Volume name.
  • : volume's group ID.
  • : Path within the jail to mount the volume.
  • : volume's user ID.
  • : volume's file mode.
  • : File system type.
Multiple: Yes

Create a directory and an appjail-fstab(5)'s entry to mount /tmp/.X11-unix within the jail. The directory is created with permissions ‘1777’.

Type: Boolean
Multiple: No
Conflicts (any):

="input:file [compress:algo]"

Create a new jail by importing a ZFS image into the jail directory.

Type: Options
Parameters:

  • : ZFS image.
  • : Change the compression algorithm. Automatic detection of the algorithm used by the ZFS image is performed, but if it fails or you need to change for some reason, you do so using this subparameter.
Multiple: No
Conflicts (any):
="input:file [compress:algo]"

Create a new jail by importing a ZFS image into the root directory of the jail.

Type: Options
Parameters:

  • : ZFS image.
  • : Change the compression algorithm. Automatic detection of the algorithm used by the ZFS image is performed, but if it fails or you need to change for some reason, you do so using this subparameter.
Multiple: No
Conflicts (any):

If you create a jail with appjail quick, the jail is marked as dirty until you finish creating it. Creation implies that all options used implicitly or explicitly are done. Keep this in mind when using options like login, as the jail is dirty until the session ends. See appjail-jail(1) for more details, but basically this means that appjail quick considers that this jail failed in some way and can proceed to remove it without the user's permission.

The following examples show how to use appjail quick and assume that you have some things like the loopback interface used by LinuxJails or that you already have the components downloaded by appjail-fetch(1) to create jails. See appjail-tutorial(7) if you want more information on how to configure these things.

# appjail quick jtest start overwrite=force

# appjail quick jtest overwrite=force start virtualnet=":<random> default" nat

# appjail quick ubuntu \
     start \
     overwrite=force \
     osversion=jammy \
     type=linux+debootstrap \
     linuxfs \
     device='include $devfsrules_hide_all' \
     device='include $devfsrules_unhide_basic' \
     device='include $devfsrules_unhide_login' \
     device='path shm unhide' \
     device="path 'shm/*' unhide" \
     template=/usr/local/share/examples/appjail/templates/linux.conf

# appjail quick ubuntu \
     start \
     overwrite=force \
     osversion=jammy \
     type=linux+debootstrap \
     linuxfs \
     device='include $devfsrules_hide_all' \
     device='include $devfsrules_unhide_basic' \
     device='include $devfsrules_unhide_login' \
     device='path shm unhide' \
     device="path 'shm/*' unhide" \
     template=/usr/local/share/examples/appjail/templates/linux.conf \
     virtualnet=":appjail0 default" \
     nat \
     alias

The appjail quick utility exits 0 on success, and >0 if an error occurs.

appjail(1) appjail-jail(1) appjail-makejail(1) appjail.conf(5) appjail-template(5) appjail-makejail(5)

Jesús Daniel Colmenares Oviedo <DtxdF@disroot.org>

Most of the options described in this document are executed after the jail performs some specific operation, e.g. start or stop it.

March 30, 2024 FreeBSD 14.3-RELEASE

Search for    or go to Top of page |  Section 1 |  Main Index

Powered by GSP Visit the GSP FreeBSD Man Page Interface.
Output converted with ManDoc.