Synopsis #
FreeBSD supplies the jail mechanism, jail.conf, lifecycle commands, ZFS integration, resource controls, and networking primitives. A jail manager composes those facilities into release, storage, network, template, backup, or orchestration workflows.
Use native configuration when the small amount of visible local policy is an advantage. Add a manager when its maintained lifecycle replaces enough local glue to justify another configuration format and upgrade dependency.
Prefer native jails when the boundary is small #
Native jail.conf is a strong fit when:
- only a few long-lived jails exist;
- each jail has intentionally different configuration;
- release installation and upgrades are already automated elsewhere;
- direct review of mounts, addresses, and permissions is important;
- no image catalogue or multi-host orchestration is required.
The host configuration remains ordinary FreeBSD state. service jail, jls, jexec, rctl, PF, ZFS, and rc.d can be inspected without translating a manager’s model.
Native does not mean manual. Configuration files and scripts can be kept under version control and deployed with an existing configuration-management system.
Prefer a manager when lifecycle repetition dominates #
A manager can earn its place when it provides several required capabilities as one coherent workflow:
- fetching and maintaining jail releases;
- repeatable application templates or image builds;
- consistent NAT, VNET, bridge, and port-mapping operations;
- import, export, migration, and cloning;
- multi-host scheduling or an application catalogue;
- unified jail and bhyve administration.
The cost is a second lifecycle. Its package, configuration schema, release support, backup format, and project health must be reviewed alongside FreeBSD itself.
Evaluate ownership, not command count #
For each candidate, determine who owns:
| Boundary | Question |
|---|---|
| Release files | Are they shared, copied, or installed from pkgbase? |
| Network | Which tool creates addresses, bridges, epairs, NAT, and inbound rules? |
| Storage | Which datasets and mount tables are created, and who snapshots them? |
| Configuration | Can the resulting jail and host state be inspected with base tools? |
| Recovery | Is there a documented export and an independently tested restore? |
| Upgrades | Does the project support every FreeBSD release in use? |
| Exit | Can jails and data be migrated without retaining the manager forever? |
The smallest command is not necessarily the smallest system. A manager that hides an important host change creates work later even if initial creation is convenient.
Select the next guide #
For an overview of maintained approaches and their different scopes, see Compare jail managers and OCI tooling . For a conventional managed workflow, start with Create a first jail with Bastille .
If the workload requires another kernel, stronger kernel isolation, or device emulation, the correct comparison is Choose a jail or a bhyve virtual machine , not another jail manager.