Telescope on FreeBSD 13 Inside a Jail

Introduction

This topic is totally new for me and it took additional to understand and get this done. Jails are confined environments to isolate services and/or processes, but you can do whatever you want with jails. The use case here is to mess up with unstable/development software while keep the system clean.

If you trust the source of a software, whereas is git repo or tarball, you probably do not need to jump through all these loopholes to get a simple TUI Gemini client, however it may be worthy to give it a try.

FreeBSD offers a variety of solution which I will not examine here but I'd like to leave a couple links:

FreeBSD Handbook: Jail.

Michael W. Lucas - FreeBSD Jail Management Tools

By my hand I decided to use "ezjail" for two reason it looks like is well documented anywhere on the internet and it is written in shell hence does not requires additional packages.

"From Micahel W. Lucas: ezjail – perhaps the best known jail management tool. Written entirely in shell."

Let's Start

The official documentations miss specific parts that might be trivials for expert sysadmins but are complicated to handle for desktop users; so far all the information I needed to complete this documentations are here:

EZJail: quick start

http://kbeezie.com/freebsd-jail-single-ip/

https://www.secure-computing.net/wiki/index.php/FreeBSD_jails_with_ezjail

http://abowhill.github.io/ezjail-setup.html

https://dan.langille.org/2014/04/03/installing-ezjail-3-3-on-freebsd-9-2-using-zfs/

Setup ezjail

To begin install the software:

Add a loopback interface in /etc/rc.conf

Enable the loopback interface:

Create a pool for the jail

Ezjail can benefit from zfs, create the pool:

Modify the /usr/local/etc/ezjail.conf

Start the service:

Populate the jail with "a basejail based on the FreeBSD RELEASE matching that of the host computer":

Before to create the jail we should look about the network interfaces:

This is the output from this VM:

We already knew the interface is ue0 because the tethering, we then chose an IP from the internal network; for the jail I am going to use: 192.168.32.214; just right next the IP of the VM.

Create the jail

I am going to call this "gem":

Here is the fix:

https://forums.freebsd.org/threads/ezjail-says-ip-is-not-configured-on-a-local-interface.54060/

"For syslogd(8) add this to rc.conf:""

Restart syslogd:

Allow ping and other stuff modifying:

Make this setting permanent editing "/etc/sysctl.conf"

Start the jail

a warning message:

/etc/rc.d/jail: WARNING: Per-jail configuration via jail_* variables is obsolete. Please consider migrating to /etc/jail.conf.

Admin the Jail

To begin:

Go inside the Jail:

The jail’s time zone can be set with tzsetup(8). To avoid spurious error messages, the adjkerntz(8) entry in /etc/crontab can be commented or removed. This job attempts to update the computer’s hardware clock with time zone changes, but jails are not allowed to access that hardware.

This will request to install PKG, say: y.

Copy inside:

Here finishes the setup of the jail.

Install Telescope dependencies:

Things are getting cocky!

Exit jail and re-enter as normal user with:

Cloning Telescope from git:

if it fails hence:

Bind the Telescope to your home editing "/etc/fstab.gem"

Now the "jailed" Telescope is bound with the real home, since jail and my home share the same name, the process is totally transparent.

Last thing to do is to compile and enabling DucklingProxy. This is exactly why the jail comes handy because I do not code, I do not understand anything about go, and I do not want go installed on my real system but I do not care messing the jail, which is exactly the meaning of all of this documentation!

Duckling-Proxy

Duckling-Proxy is a proxy utility that translate HTML pages in GEMTEXT pages, it has many limitations hence pages that rely heavily on javascript and the like will not even rendered but the so called "small web" should be rendered almost readable.

The utility is written in GO thus is necessary install the GO environment.

Installing GO

Go is available as port:

Installing Duckling-Proxy

I was unable to compile it on Linux but on FreeBSD has been a breeze:

Duckling-Proxy requires certificate to work, you can reuse ones that you already have or create brand new certificate

All the information to setup Duckling-Proxy are already available here:

Watching the Gemini-space through a "Telescope" (part 3)

If Internet is not working anymore!

I recently realized that since the connection is using DHCP your IP may change and therefore the jail cannot communicate with the external, if you notice it you can verify running an "ifconfing" command:

As you can see the first inet line is your current IP address:

While the second inet line is the one that has been setup accordingly to this documentation:

In order to restore the connection you must follow the following step:

Since the new current host IP is 192.168.170.198 I used the same rule I used the very first time and I assigned to the jail the next IP number.

Now the connection should be re-enabled!

Updating the Jail

This is something that I had to deal recently.

Apparently the "good way" to use the jails is building the "world", basically regenerating the whole three ports and therefore using the ports collection rather than the packages.

Apparently the "good way" to use the jails is building the "world"

I used instead packaging because building the world might be blazing fast on a server class computer but is awfully slow on limited virtual machine. Also the use of packaging help when you try to simulate what you are going to do to your real OS.

I tested all the commands as for the documentation:

FreeBSD Handbook: 15.6. Managing Jails with ezjail

But for this case specifically the following one is the correct:

Which produces a lot of warnings:

Those warnings should not represent any issues since:

It's not failing actually, it's only complaining there's no source and no kernel. Both of which can be ignored.
is purely cosmetic.

As reported here:

FreeBSD Forum: Updating jails with ezjail-admin fails

Wrapping This Up!

Now you can test or run development versions of Telescope in jail while using the releases outside the jail, you can also copy the binary of duckling-proxy in your home run it from there while keeping the go dependencies only live in the jail.

I don't think I have anything else to add hence you can come back to Part 03:

↩ Go back to "Part 03"

For comments or suggestion write me at:

freezr AT disroot DOT org

↩ go back

(last edit February 2, 2022)
Proxied content from gemini://omg.pebcak.club/~freezr/gemlog/2021-11-19-telescope-on-freebsd-jail.gmi (external content)

Gemini request details:

Original URL
gemini://omg.pebcak.club/~freezr/gemlog/2021-11-19-telescope-on-freebsd-jail.gmi
Status code
Success
Meta
text/gemini;lang=en
Proxied by
kineto

Be advised that no attempt was made to verify the remote SSL certificate.