I need to create a freebsd jail for web hosting, that will be frequently migrated between hosts.

How feasible is it? Can I use domains instead of IPs? can I use wildcard IPs?

I need this to benchmark different hw/sw configuration against a known resource hogger.

  • Jails really don't "migrate" like that -- can you be a little more specific about what you're trying to do?
    – voretaq7
    Nov 9, 2012 at 21:19
  • DDoS protection for gameservers. The idea is to have one big DDoS protected host, and move jails from non protected machines in case of attack.
    – Mascarpone
    Nov 13, 2012 at 15:02

2 Answers 2


For what you're describing, "jail migration" is almost certainly the Wrong Solution -- you really want to apply DDoS protection across your whole network, not just a specific host/set of IPs.

More generally, as I said in my comment, Jails don't "migrate" in the way you're describing. Some folks have done creative things with geom_mirror and ggated, but this is more failover than at-will migration, and I would describe the process as "cumbersome" at best.
Live migrations of running virtual machines (either at-will or automatic for resource balancing) is really better left to true hypervisor systems like VMWare and Hyper-V (Linux KVM may be getting there, and one day it might be a project that the FreeBSD Jail folks take on, but Jails are really designed to be process/system isolation -- a chroot on steroids -- rather than a VM you can pick up and move from host to host. Migration is one of those things that takes a lot of programming effort).

Some things I know you can't do are use a "wildcard IP" -- IP addresses are assigned to both the underlying host system and the jail, so migrating requires you to move the IP addresses around. You could use DNS to make the switchover (running both a protected and unprotected copy of the jail and using techniques similar to those in the link I described), but that's guaranteed to have some crossover time (at least the TTL of the record), and is basically asking you to double your hardware & IP space commitment -- probably not feasible unless you charge a lot more for the privilege of having this service (and if you're going to do that and can only give DDoS protection to a portion of your infrastructure you may as well just charge people a lot more to be on the DDoS-protected systems full-time -- it's a much smaller administrative headache).

  • IP wildcards are working since a while, and I dont like that this post makes a lot of conjectures about my netwrok, anyhow I agree with you that it might require a lot of brand new scripting
    – Mascarpone
    Nov 13, 2012 at 23:58
  • since freebsd 6.x wiki.freebsd.org/Jails
    – Mascarpone
    Nov 13, 2012 at 23:58
  • @Mascarpone The IP still needs to be configured on the base host (which is where most of the scripting work comes in). Also to be blunt if you do not want us to make conjectures you need to give us all the contextual information. Based on what I can see you are asking to do something which in my experience (with FreeBSD, network design, and having run gaming servers in the past) seems ill advised -- The folks around here will try to help you out as much as possible, but we'll also try to keep you from causing yourself any more pain than is absolutely necessary :-)
    – voretaq7
    Nov 14, 2012 at 16:19

I'm also looking for a jail migration tools. I am using the ezjail and rsync for jail management/moving between hosts and I need to have more complex solution. Google found something interesting on http://bsdstore.ru but the project is very poorly documented

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .