go-freebsd-jail

FreeBSD jail management for Go with native libjail bindings — create, update, remove, list, exec, VNET networking and jail.conf parsing.

Gojails · libjail · vnet · cgofreebsd from go source on github

Why

Manage jails from Go through jail_set(2), jail_get(2) and jail_remove(2) instead of driving jail(8) — with an idempotent CreateOrUpdate for declarative, reconcile-style management.

How

A small C shim over libjail’s jailparam_* API returns the jail id, errno and libjail’s error message together, so nothing is lost crossing the cgo boundary.
Go config structs become a flat parameter list; reserved parameters can’t be overridden through raw params, and input is validated before any syscall.
exec deliberately shells out to jexec instead of calling jail_attach in-process — attaching a multithreaded Go runtime to a jail isn’t safe.
The vnet package uses go-freebsd-ifc to build the epair and bridge on the host; jailconf renders and parses jail.conf.
Sentinel errors plus structured operation and validation errors. Builds on any OS — non-FreeBSD stubs return ErrNotSupported. End-to-end tests run as root using /rescue as a minimal jail root.

jid, err := jail.Create(jail.Config{
    Name: "web", Path: "/jails/web", Hostname: "web.local", Persist: true,
    VNET: true, VNETInterface: []string{"epair0b"},
})

$ git clone https://github.com/zombocoder/go-freebsd-jail

← all projects