Create
14 minute read.
Last Modified 2021-04-14 08:03 EDTThis feature is only supported by the TrueNAS CORE community.
Jails are a lightweight, operating-system-level virtualization. One or multiple services can run in a jail, isolating those services from the host TrueNAS system. TrueNAS uses iocage for jail and plugin management. The main differences between a user-created jail and a plugin are that plugins are preconfigured and usually provide only a single service.
It is important to understand that users, groups, installed software, and configurations within a jail are isolated from both the TrueNAS host operating system and any other jails running on that system.
The ability to create multiple jails offers flexibility regarding software management. For example, an administrator can choose to provide application separation by installing different applications in each jail, to create one jail for all installed applications, or to mix and match how software is installed into each jail.
A data storage pool must be created before using jails. Make sure the pool has enough storage for all the intended jails. The Jails screen displays a message and button to CREATE POOL if no pools exist on the TrueNAS system.
If pools exist, but none have been chosen for use with jails or plugins, a dialog appears to choose a pool. Select a pool and click CHOOSE.
To select a different pool for jail and plugin storage, click settings. A dialog shows the active pool. A different pool can be selected from the drop-down.
Jails and downloaded FreeBSD release files are stored in a dataset named iocage/
.
TrueNAS has two options to create a jail. The Jail Wizard makes it easy to quickly create a jail. ADVANCED JAIL CREATION is an alternate method, where every possible jail option is configurable. There are numerous options spread across four different primary sections. This form is recommended for advanced users with very specific requirements for a jail.
New jails can be created quickly by going to Jails > ADD.
The wizard provides the simplest process to create and configure a new jail.
Enter a Jail Name
. Names can contain letters, numbers, periods (.
), dashes (-
), and underscores (_
).
Choose a Jail Type
: Default (Clone Jail) or Basejail. Clone jails are clones of the specified FreeBSD RELEASE. They are linked to that RELEASE, even if they are upgraded. Basejails mount the specified RELEASE directories as nullfs mounts over the jail directories. Basejails are not linked to the original RELEASE when upgraded.
Jails can run FreeBSD versions up to the same version as the host TrueNAS system. Newer releases are not shown.
Versions of FreeBSD are downloaded the first time they are used in a jail. Additional jails created with the same version of FreeBSD are created faster because the download has already been completed.
Click NEXT to see a simplified list of networking options.
Jails support several different networking solutions:
VNET adds a virtual network interface to the jail. This interface can set NAT, DHCP, or static jail network configurations. Since VNET provides the jail with an independent networking stack, it can broadcast an IP address, which is required by some applications.
Network Address Translation (NAT), which uses the TrueNAS IP address and sets a unique port for the jail to use. VNET is required when NAT is selected.
Set DHCP Autoconfigure IPv4 for the jail to receive its IP address from a DHCP server.
Manually configure networking by entering values for the IPv4 Address or IPv6 Address fields. Any combination of these fields can be configured. Multiple interfaces are supported for IPv4 and IPv6 addresses. To add more interfaces and addresses, click ADD.
Setting the IPv4 Default Router and IPv6 Default Router fields to auto automatically configures these values. VNET must be set to enable the IPv4 Default Router field. When no interface is selected when manually configuring IP addresses, TrueNAS automatically assigns the given jail IP address to the current active interface of the host system.
Leaving all checkboxes unset and fields empty initializes the jail without any networking abilities. Networking is added to the jail after creation by going to Jails, clicking chevron_right for a jail, then edit > Basic Properties.
Setting a proxy in the TrueNAS network settings also configures new jails to use the proxy settings, except when performing DNS lookups. Make sure a firewall is properly configured to maximize system security.
When pairing the jail with a physical interface, edit the network interface and set Disable Hardware Offloading. This prevents a network interface reset when the jail starts.
Click NEXT to view a summary screen of the chosen jail options. Click SUBMIT to create the new jail. After a few moments, the new jail is added to the primary jails list.
The advanced jail creation form is opened by clicking Jails > ADD, then ADVANCED JAIL CREATION.
A usable jail without any networking can be quickly created by setting only the required Jail Name and Release. Configure the remaining Basic Properties when the jail needs to communicate over the local network or out to the internet.
Basic Properties
Name | Description |
---|---|
Name | Required. Can contain letters, numbers, periods (.), dashes (-), and underscores (_). |
Jail Type | Default (Clone Jail) or Basejail. Clone jails are clones of the specified RELEASE. They are linked to that RELEASE, even if they are upgraded. Basejails mount the specified RELEASE directories as nullfs mounts over the jail directories. Basejails are not linked to the original RELEASE when upgraded. |
Release | FreeBSD release to use as the jail operating system. Jails can run FreeBSD versions up to the same version as the host system. Newer releases are not shown. |
DHCP Autoconfigure IPv4 | Set to autoconfigure jail networking with the Dynamic Host Configuration Protocol. VNET and Berkeley Packet Filter must also be enabled. |
NAT | Network Address Translation (NAT). Transforms local network IP addresses into a single IP address. Set when the jail will share a single connection to the Internet with other systems on the network. |
VNET | Set to use VNET(9) to emulate network devices for the jail. A fully virtualized per-jail network stack will be installed. |
Berkeley Packet Filter | Set to use the Berkeley Packet Filter (BPF(4)) to data link layers in a protocol independent fashion. |
vnet_default_interface | Set the default VNET interface. Only takes effect when VNET is set. Choose a specific interface or set to auto to use the interface that has the default route. Choose none to not set a default VNET interface. |
IPv4 Interface | IPv4 interface for the jail. |
IPv4 Address | Enter the IPv4 address for VNET(9) and shared IP jails. |
IPv4 Netmask | IPv4 netmask for the jail. |
IPv4 Default Router | A valid IPv4 address to use as the default route. Enter none to configure the jail with no IPv4 default route. A jail without a default route will not be able to access any networks. |
AutoConfigure IPv6 | Set to use SLAAC (Stateless Address Auto Configuration) to autoconfigure IPv6 in the jail. |
IPv6 Interface | IPv6 interface for the jail. |
IPv6 Address | Enter the IPv6 address for VNET(9) and shared IP jails. |
IPv6 Netmask | IPv6 prefix for the jail. |
IPv6 Default Router | A valid IPv6 address to use as the default route. Enter none to configure the jail without an IPv6 default route. A jail without a default route will not be able to access any networks. |
Auto Start | Set to auto-start the jail at system boot time. Jails are started and stopped based on iocage priority. Set in the priority field under Custom Properties. |
Additional settings are in the Jail Properties, Network Properties, and Custom Properties sections.
Template jails are basejails that can efficiently create jails with the same configuration. These steps create a template jail:
- Go to Jails > ADD > ADVANCED JAIL CREATION.
- Select Basejail as the Jail Type. Configure the jail with desired options.
- Set template in the
Custom Properties
section. - Click SAVE.
- Click ADD.
- Enter a name for the template jail. Leave Jail Type as Default (Clone Jail). Set Release to basejailname(template), where basejailname is the name of the base jail created earlier.
- Complete the jail creation wizard.