TrueNAS CORE
TrueNAS Enterprise
TrueNAS SCALE
TrueCommand
Compare Editions
Software Status
FreeNAS
Compare Systems
M-Series
X-Series
R-Series
Mini Series
Download TrueNAS CORE
Download TrueNAS SCALE
Get TrueNAS Enterprise
Where to BuyTrueNAS CORE Version Documentation
This content follows the TrueNAS CORE 13.0 releases. Use the Product and Version selectors above to view content specific to different TrueNAS software or major version.
Jails Screens
14 minute read.
Last Modified 2024-03-19 09:02 EDTThe Jails screen displays a list of jails installed on your system. Use to add, edit or delete jails.
Use the blue Columns dropdown list to display options to change the information displayed in the lis to of tables. Options are Select All, JID, Boot, State, Release, IPv4, IPv6, Type, Template, Basejail or Reset to Defaults.
Use the icon to set the pool to use for jail storage.
Use ADD to display the first configuration Wizard screen and to access the ADVANCED JAIL CREATION button to display advanced jail configuration screens.
Click the icon to display the individual jail screen with its primary settings and additional action options for that jail.
Click the icon to collaspe the individual jail screen.
| Name | Description |
|---|---|
| EDIT | Used to modify the settings described in Advanced Jail Creation. You cannot edit a jail while it is running. You can only view the settings that are read only until you stop the jail operation. |
| MOUNT POINTS | Select an existing mount point to edit. Either click EDIT or click ACTIONS > Add Mount Point to create a mount point for the jail. A mount point gives a jail access to storage located elsewhere on the system. You must stop a jail before adding, editing, or deleting a mount point. See Additional Storage for more details. |
| RESTART | Stops and immediately starts a jail that is running or up. |
| START | Starts a jail that has a current STATE of down. |
| STOP | Stops a jail that has a current STATE of up. |
| UPDATE | Runs freebsd-update to update the jail to the latest patch level of the installed FreeBSD release. |
| SHELL | Displays the Shell screen which provides access a root command prompt to interact with a jail directly from the command line. Type exit to leave the command prompt and display the Jails screen. |
| DELETE | Deletes the selected jail. Caution: deleting the jail also deletes all of the jail contents and all associated snapshots. Back up the jail data, configuration, and programs first. There is no way to recover the contents of a jail after deleting it! |
Action options change based on the jail state. For example, a stopped jail does not have a STOP or SHELL option.
TrueNAS has two options to create a jail. The Jail Wizard makes it easy to create a jail. ADVANCED JAIL CREATION opens the advanced configuration screens with all possible configuration settings. This form is recommended only for advanced users with ver specific requirements for a jail.
Use the jail-creation Wizard to add a new jail by following and completing required fields in a pre-determimed order. The wizard provides the simplest process to create and configure a new jail. Click ADD to display the first of three Wizard configuration screens.
Use Next to advance to the next screen. Use Back to return to the previous screen. Use SUBMIT to save all settings and create the Jail. Use Cancel to close the current screen exit the configuation process without saving.
| Setting | Description |
|---|---|
| Name | Required field. Enter a name that can include letters, numbers, periods (.), dashes (-), and underscores (_). |
| Jail Type | Select an option from the dropdown-list. Options are Default (Clone Jail) or Basejail. Use Default (Clone Jail) to clone jails that are clones of the specified value in Release. They are linked to that release, even if they are upgraded. Use Basejails to mount the specified release directories as nullfs mounts over the jail directories. Basejails are not linked to the original release when upgraded. Versions of FreeBSD are downloaded the first time they are used in a jail. Additional jails created with the same version of FreeBSD are created faster because the download is already complete. |
| Release | Select an option from the dropdown list. Options are 12.2-RELEASE or 13.0-RELEASE. This is the FreeBSD release to use as the jail operating system. Jails can run FreeBSD versions up to the same version as the host system. Newer releases are not shown. |
| Advanced Jail Creation | Opens the advanced configuration screens. This form is recommended only for advanced users with ver specific requirements for a jail |
| Name | Description |
|---|---|
| DHCP Autoconfigure IPv4 | Select to auto-configure jail networking with the Dynamic Host Configuration Protocol (DHCP). Also select VNET and Berkeley Packet Filter with this selected option. |
| NAT | Network Address Translation (NAT) to transform local network IP addresses into a single IP address. Select when the jail shares a single connection to the Internet with other systems on the network. |
| VNET | Select to use VNET(9) to emulate network devices for the jail. A fully virtualized per-jail network stack is installed. |
| vnet_default_interface | Select the default VNET interface from options on the dropdown list. Options are none, auto, or specific interfaces on your system. Only takes effect when VNET is selected. Choose a specific interface or set to auto to use the interface that has the default route. Choose none to not set a default VNET interface. |
| IPv4 Interface | Select the IPv4 interface for the jail from the dropdown list. |
| IPv4 Address | Enter the IPv4 address for VNET(9) and shared IP jails. |
| IPv4 Netmask | Select the IPv4 netmask for the jail from the dropdown list. |
| IPv4 Default Router | Enter a valid IPv4 address to use as the default route. Enter none to configure the jail with no IPv4 default route. A jail without a default route is not be able to access any networks. |
| AutoConfigure IPv6 | Select to use Stateless Address Auto Configuration (SLAAC) to autoconfigure IPv6 in the jail. |
| IPv6 Interface | Select the IPv6 interface for the jail from the dropdown list. |
| IPv6 Address | Enter the IPv6 address for VNET(9) and shared IP jails. |
| IPv6 Prefix | Select the IPv6 prefix for the jail from the dropdown list. |
| IPv6 Default Router | Enter a valid IPv6 address to use as the default route. Enter none to configure the jail without an IPv6 default route. A jail without a default route is not be able to access any networks. |
Displays a screen that summarizes the Jail settings entered or selected on the Wizard screens.
The Advanced Jail Creation screens include four expandable configuration areas:
- Basic Properties
- Jail Properties
- Network Properties
- Custom Properties
Click the icon to collaspe any area of configuration settings.
Use Next to advance to the next configuration settings section, or click the icon to expand the configuration settings area.
| Name | Description |
|---|---|
| Name | Required field. Enter a name that can include letters, numbers, periods (.), dashes (-), and underscores (_). |
| Jail Type | Select an option from the dropdown-list. Options are Default (Clone Jail) or Basejail. Use Default (Clone Jail) to clone jails that are clones of the specified value in Release. They are linked to that release, even if they are upgraded. Use Basejails to mount the specified release directories as nullfs mounts over the jail directories. Basejails are not linked to the original release when upgraded. |
| Release | Select an option from the dropdown list. Options are 12.2-RELEASE or 13.0-RELEASE. This is the FreeBSD release to use as the jail operating system. Jails can run FreeBSD versions up to the same version as the host system. Newer releases are not shown. |
| DHCP Autoconfigure IPv4 | Select to auto-configure jail networking with the Dynamic Host Configuration Protocol (DHCP). Also select VNET and Berkeley Packet Filter with this selected option. |
| NAT | Network Address Translation (NAT) to transform local network IP addresses into a single IP address. Select when the jail shares a single connection to the Internet with other systems on the network. |
| VNET | Select to use VNET(9) to emulate network devices for the jail. A fully virtualized per-jail network stack is installed. |
| Berkeley Packet Filter | Select to use the Berkeley Packet Filter (BPF(4)) to data-link layers in a protocol independent fashion. |
| vnet_default_interface | Select the default VNET interface from options on the dropdown list. Options are none, auto, or specific interfaces on your system. Only takes effect when VNET is selected. Choose a specific interface or set to auto to use the interface that has the default route. Choose none to not set a default VNET interface. |
| IPv4 Interface | Select the IPv4 interface for the jail from the dropdown list. |
| IPv4 Address | Enter the IPv4 address for VNET(9) and shared IP jails. |
| IPv4 Netmask | Select the IPv4 netmask for the jail from the dropdown list. |
| IPv4 Default Router | Enter a valid IPv4 address to use as the default route. Enter none to configure the jail with no IPv4 default route. A jail without a default route is not be able to access any networks. |
| AutoConfigure IPv6 | Select to use Stateless Address Auto Configuration (SLAAC) to autoconfigure IPv6 in the jail. |
| IPv6 Interface | Select the IPv6 interface for the jail from the dropdown list. |
| IPv6 Address | Enter the IPv6 address for VNET(9) and shared IP jails. |
| IPv6 Netmask | Select the IPv6 prefix for the jail from the dropdown list. |
| IPv6 Default Router | Enter a valid IPv6 address to use as the default route. Enter none to configure the jail without an IPv6 default route. A jail without a default route is not be able to access any networks. |
| Auto Start | Select to auto-start the jail at system boot time. Jails are started and stopped based on iocage priority. Set in the Custom Properties priority field. |
| Name | Description |
|---|---|
| devfs_ruleset | The devfs(8) ruleset number to enforce when mounting devfs in the jail. The default 0 means no ruleset is enforced. Mounting devfs inside a jail is only possible when the allow_mount and allow_mount_devfs permissions are enabled and enforce_statfs is set to a value lower than 2. |
| exec_start | Commands to run in the jail environment after the jail is created. Example: sh /etc/rc. The pseudo-parameters section of JAIL(8) describes exec.start usage. |
| exec_stop | Commands to run in the jail environment before the jail is removed and after exec.prestop commands complete. Example: sh /etc/rc.shutdown. |
| exec_prestart | Commands to run in the system environment before a jail is started. |
| exec_poststart | Commands to run in the system environment after a jail is started and after any exec_start commands are finished. |
| exec_prestop | Commands to run in the system environment before a jail is stopped. |
| exec_poststop | Commands to run in the system environment after a jail is stopped. |
| exec_jail_user | Enter either root or another valid username. Inside the jail, this user runs the commands. |
| exec_system_user | Run commands in the jail as this user. By default, the current user runs these commands. |
| securelevel | The value of the jail securelevel sysctl. A jail never has a lower securelevel setting than the host system. Setting this parameter allows a higher securelevel setting. If the host system securelevel* setting is changed, the jail secure level is at least as secure. |
| sysvmsg | Allows or denies access to SYSV IPC message primitives. Use the dropdown list to select from Inherit, New or Disable. Select Inherit to make all IPC objects on the system visible to the jail. Select *New to make only objects the jail creates using the private key namespace visible. The system and parent jails have access to the jail objects but not private keys. Select Disable when the jail cannot perform any sysvmsg related system calls. |
| sysvsem | Allows or denies access to SYSV IPC semaphore primitives. Use dropdown list to select from Inherit, New or Disable. Use Inherit to make all IPC objects on the system visible to the jail. Select New to make only objects the jail creates using the private key namespace visible. The system and parent jails have access to the jail objects but not private keys. Select Disable when the jail cannot perform any sysvmem related system calls. |
| sysvshm | Allows or denies access to SYSV IPC shared memory primitives. Use dropdown list to select from Inherit, New or Disable. Select Inherit to make all IPC objects on the system visible to the jail. Select New to make only objects the jail creates using the private key namespace visible. The system and parent jails have access to the jail objects but not private keys. Select Disable when the jail cannot perform any sysvshm related system calls. |
| vnet_interfaces | A space-delimited list of network interfaces attached to a VNET enabled jail after it is created. Interfaces are released when the jail is removed. |
| allow_set_hostname | Select to allow changing the jail host name with hostname(1) or sethostname(3). |
| allow_sysvipc | Select to choose whether a process in the jail has access to System V IPC primitives. Equivalent to setting sysvmsg, sysvsem, and sysvshm to Inherit. Deprecated in FreeBSD 11.0 and newer! Use sysvmsg, sysvsem, and sysvshm instead. |
| allow_raw_sockets | Select to allow raw sockets. Utilities like ping(8) and traceroute(8) require raw sockets. When selected, source IP addresses are enforced to comply with the IP addresses bound to the jail, ignoring the IP_HDRINCL flag on the socket. |
| allow_chflags | Select to treat jail users as privileged and allow the manipulation of system file flags. Secure level constraints are still enforced. |
| allow_mlock | Enables running services that require mlock(2) in a jail. |
| allow_vmm | Allows the jail to access the bhyve virtual machine monitor (VMM). The jail must have FreeBSD 12.0 or newer installed with the vmm(4) kernel module loaded. |
| allow_quotas | Select to allow the jail root to administer quotas on jail file systems. This includes file systems the jail shares with other jails or with non-jailed parts of the system. |
| allow_socket_af | Select to allow access to other protocol stacks beyond IPv4, IPv6, local (UNIX), and route. Warning, jail functionality does not exist for all protocol stacks. |
| allow_mount | Select to allow privileged users inside the jail to mount and unmount file system types marked as jail-friendly. Also use dropdown list to select from list of options allow_mount_devfs, allow_mount_fusefs, allow_mount_nullfs, allow_mount_procfs, allow_mount_tmpfs or allow_mount_zfs. |
| Name | Description |
|---|---|
| Interfaces | Use to enter up to four interface configurations in the format interface:bridge, separated by a comma (,), where the left value is the virtual VNET interface name and the right value is the bridge name where to attach the virtual interface. |
| host_domainname | Use to enter a NIS domain name for the jail. |
| host_hostname | Use to set the jail host name. Defaults to the jail UUID. |
| resolver | Use to add lines to the jail resolv.conf. For example, nameserver IP;search domain.local. Delimit fields with a semicolon (;), this translates as new lines in resolv.conf. Enter none to inherit resolv.conf from the host. |
| exec_fib | Enter the routing table (FIB) to use when running commands inside the jail. |
| ip4.saddrsel | Select to disable IPv4 source address selection for the jail in favor of the primary IPv4 address of the jail. Only available when the jail is not configured to use VNET. |
| ip6.saddrsel | Select to disable IPv6 source address selection for the jail in favor of the primary IPv6 address of the jail. Only available when the jail is not configured to use VNET. |
| ip4 | Controls the availability of IPv4 addresses. Use the dropdown list to select from options inherit, New or Disable. Select Inherit to allow unrestricted access to all system addresses. Select New to restrict addresses with ip4_addr. Select Disable to stop the jail from using IPv4 entirely. |
| ip6 | Controls the availability of IPv6 addresses. Use the dropdown list to select from options inherit, New or Disable. Select Inherit to allow unrestricted access to all system addresses. Select New to restrict addresses with ip6_addr. Select Disable to stop the jail from using IPv6 entirely. |
| mac_prefix | Enter a valid MAC address vendor prefix. For example, E4F4C6. |
| vnet0_mac | Use to assign a fixed MAC address. Leave this field empty to generate random MAC addresses for the host and jail. To assign fixed MAC addresses, enter the MAC address to assign to the host, a space, then the MAC address to assign to the jail. |
| Name | Description |
|---|---|
| priority | Enter a numeric start priority for the jail at boot time. Valid priorities are between 1 and 99. Smaller values are higher priority. At system shutdown the priority is reversed. For example, 99. |
| hostid | Enter a new jail host id, if desired. For example, the hostid: 1a2bc345-678d-90e1-23fa-4b56c78901de. |
| comment | Enter comments about the jail. |
| template | Select to set this jail as a template. |
| host_time | Select to set system host time to synchronize the time between jail and host. |
| jail_zfs | Select to enable automatic ZFS jailing inside the jail. The jail fully controls the assigned ZFS dataset. |
| jail_zfs_dataset | Enter a ZFS file system name without a pool name to define the jailed dataset and fully hand over to a jail. You must set jail_zfs for this option to work. |
| jail_zfs_mountpoint | Enter the mount point for the jail_zfs_dataset. For example, /data example-dataset-name. |
| allow_tun | Select to reveal tun devices for the jail with an individual devfs ruleset. Allows the creation of tun devices in the jail. |
| Autoconfigure IPv6 with rtsold | Select to use rtsold(8) as part of IPv6 auto-configuration. Send ICMPv6 router solicitation messages to interfaces to discover new routers. |
| ip_hostname | Select to use DNS records during jail IP configuration to search the resolver and apply the first open IPv4 and IPv6 addresses. See jail(8). |
| assign_localhost | Select to add network interface lo0 to the jail and assign it the first available localhost address, starting with 127.0.0.2. The Basic Properties VNET checkbox must be cleared. Jails using VNET configure a localhost as part of their virtualized network stack. |