Hacker News new | past | comments | ask | show | jobs | submit login

Docker is just namespaces and cgroups. You do not have separation between host and the containers on Linux - you need additional software for that - like AppArmor or SELinux. The FreeBSD Jails are secure and separated from the host on the contrary. FreeBSD Host can access Jails but Jails can not access Host resources - unless consciously configured to do so.

As for the usage ... FreeBSD Jails can have their OWN network stack (with own firewall and interfaces) while Docker can only use Linux network namespaces.

You can launch/start a single process Jail and a single process Docker - here they are similar. You can also unpack entire operating system userland in both and it will also run - with own packages database etc.

Hope that helps.




You do know that Docker applies AppArmor by default, right..? https://docs.docker.com/engine/security/apparmor/


... on RHEL/CentOS/Alma/Rocky Linux which use SELinux instead? :)



Okay, thanks for the information! Sounds like I would still prefer jails. Managing Docker always sounded complicated compared to managing jails. It is literally just a configuration file and a copy of userland on the file system. If you are a little clever, you can share the userland and additionally create templates which are really just some directories on your file system with additional stuff you want to put in.


You can also use linux containers (LXC) which are basically "freebsd jails for linux". If you want something easy to use, you can try Promox.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: