Taking/deleting snapshots outside jail

[fcorbelli]

Is it possible, from an application within a jail, to take (and perhaps even delete) snapshots from a 'global' dataset?
"Global" in the sense of "outside the jail"?
The aim is to use backup applications, based on snapshots of TrueNAS datasets, from within a jail.
Thanks for any reply

 

[jgreco]

Yes. Set up sshd on the host NAS to accept ssh connections from the jail. Then you may issue whatever commands you wish, and you can even scope the allowed access if you run it via sudo.

 

[fcorbelli]

Therefore only with a ssh session?

 

[jgreco]

Therefore only with a ssh session?

No. It's computer science. There's a thousand ways to do it, many more stupid than others. The upsides to ssh would be that it's an exceedingly clean and flexible interface by which to do this.

 

[fcorbelli]

It certainly will be, but it requires the use of a tool (ssh) that requires some configuration.
So is it not possible, even by "dirty" and "inflexible" methods, to do something like "zfs snapshot something" ?
Basically something that can be used in a script, without running commands through ssh

 

[Ericloewe]

You could conceptually delegate a dataset to a jail, but the jail would have full control of it (more or less). This may or may not be what you're looking for.

 

[fcorbelli]

You could conceptually delegate a dataset to a jail, but the jail would have full control of it (more or less). This may or may not be what you're looking for.

Seems promising.
Is it possible via GUI?
And how?

 

[Ericloewe]

No GUI, as far as I know. The interface should be fairly simple on FreeBSD:

zfs-jail.8 — OpenZFS documentation

openzfs.github.io

Similar complexity on the Linux side, but the actual management of the namespace on the OS side is a far less enjoyable experience:

zfs-zone.8 — OpenZFS documentation

openzfs.github.io

 

[fcorbelli]

No GUI, as far as I know. The interface should be fairly simple on FreeBSD:

zfs-jail.8 — OpenZFS documentation

openzfs.github.io

Similar complexity on the Linux side, but the actual management of the namespace on the OS side is a far less enjoyable experience:

zfs-zone.8 — OpenZFS documentation

openzfs.github.io

Sadly
After a dataset is attached to a jail and the jailed property is set, a jailed file system cannot be mounted outside the jail

 

[Ericloewe]

If that's a dealbreaker, you'd always need a remote shell of some sort. SSH, is the sanest and most popular option for the majority of scenarios.

 

[jgreco]

SSH, is the sanest and most popular option for the majority of scenarios.

Also the most portable. Otherwise you certainly have options such as the TrueNAS API, or less-recommended methods especially ones involving a helper outside the jail. But these basically just work out to being functional variations on doing it via SSH.

 

[fcorbelli]

There is an alternative, but it has strengths and weaknesses (i.e. use program outside the jail)
I think that, albeit not enthusiastically, I will opt for this choice

 

[jgreco]

There is an alternative, but it has strengths and weaknesses (i.e. use program outside the jail)
I think that, albeit not enthusiastically, I will opt for this choice

I literally just said in my last reply "a helper outside the jail".



The proper way to do this is to have your helper executable located inside the jail filesystem namespace but launch it in the host system. On TrueNAS, you can do this with a startup task.