Linux Jails (sandboxes / containers) with Jailmaker

dasunsrule32 · May 2, 2024, 9:58pm

I have another question, this time around the GPU passthrough option. In Truenas’s Apps, I can allocate my Nvidia GPU to multiple apps. Is this possible with jailmaker? I’m thinking in line of wanting to run Plex and Jellyfin and passthrough to both as an example.

NYSundevil · May 2, 2024, 10:53pm

Thanks everyone for the help. I just needed to add the port. I must of missed that in the video. Now onto to installing the *arrs.

Stux · May 2, 2024, 10:55pm

The location bar did get cropped from the video, but I do state it, but it’s quick.

dasunsrule32 · May 2, 2024, 11:11pm

I’ve been looking into docker-compose a bit more and it looks like stacks are simply all the orchestrated containers inside the compose file. With that in mind, is the agent using docker swarm to work with multiple nodes?

Stux · May 2, 2024, 11:20pm

I don’t think it’s using swarm.

I assumed dockge is simply logging into the other dockge agents on the same port you would, and using an API to control the agent.

Yes. A dockge stack is a compose file. That’s the neat thing, you can edit them on disk, and they appear in dockge, edit them in dockge, and the changes are reflected on disk.

dasunsrule32 · May 2, 2024, 11:21pm

Ok, makes sense. Thanks!

LibertyBeta · May 3, 2024, 4:17am

So, first off, awesome little tool. I moved plex from docker to its own jail and its SOO Much less flakey.

But I need some guidance on allowing tun networking. I need to get a few wireguard/tailscale jails up and running and don’t know where to start with my config.

Jip-Hop · May 3, 2024, 9:04am

Start by checking out the old forum thread and the GitHub Discussions. Wireguard and Tailscale were mentioned their. Maybe that will get you started.

LibertyBeta · May 3, 2024, 11:32am

I’ve got the follow on GitHub, do you have a link handy for the old forum thread?

Jip-Hop · May 3, 2024, 12:06pm

See first post in this thread.

NYSundevil · May 3, 2024, 2:07pm

Follow up questions, dockge was working great but…
Tried installing a second instance of Radarr and I am unable to access it on the alternate port 17878 instead of 7878.
It’s unclear to me if I am required to setup a bridge in order to change the default docker ports and\or if the setting up a bridge the recommended solution for running jailmaker.
I did create the bridge and changed macvln to bridge in the jailmaker config file to test this theory but that prevented jailmaker from starting. I know Stux demonstrated using a bridge in his video but I had a hard time following. I’m not overly concerned with the firewall between Scale and the jailmaker apps. I really just wanted the simplest way for this to work and be maintained.

davistw · May 3, 2024, 2:07pm

First off. Jip-Hop this is an amazing tool. I know you spent untold hours and hours creating it and the Truenas experimenters owe you a GREAT debt of gratitude. How you figured all this out is amazing.

A couple of system maintenance questions.

Is there a way to rename a jail?
I have a jail I created with the wrong name "myjail"and would like to rename it “plex” to better describe it.
Is there a way to clone a jail?
I could create an boilerplate jail with my tweaks and clone it for a default jail.
Is there a way to take a jail and back it up as is intact to an offsite location like a usb drive?
This way a jail could just be restored from the backup and you would be up and running quickly.

dasunsrule32 · May 3, 2024, 3:45pm

I believe all that would be done with machinectl. Here are some of the options that you can use with machinectl. We would need @Jip-Hop to confirm if it would cause issues with jailmaker or not.

  clone NAME NAME             Clone an image
  rename NAME NAME            Rename an image

I’m not sure about backing up yet.

machinectl documentation

LibertyBeta · May 3, 2024, 4:10pm

Ah, found it. Got tailscale working fine, but still wrangling my wireguard/mullvad’ed jail

Jip-Hop · May 3, 2024, 4:16pm

Cloning is not implemented in jailmaker.

github.com/Jip-Hop/jailmaker

Create jails of existing jails or clone

opened 06:44PM - 13 Feb 24 UTC

Jip-Hop

enhancement help wanted

### Discussed in https://github.com/Jip-Hop/jailmaker/discussions/42 <div typ…e='discussions-op-text'> <sup>Originally posted by **rubiktubik** October 11, 2023</sup> A good feature would be a clone of an existing jail. So I can create a jail with docker installed for example and quickly clone this one to create other jails with docker installed. I don't know if this is possible with systemd-nspawn but this would be nice</div> <hr> Consider implementing `jlmkr clone` or `jlmkr duplicate` method. Keep in mind #80 when implementing this. Also look out for [hostname conflicts](https://github.com/Jip-Hop/jailmaker/discussions/21#discussioncomment-6786458), machine-id conflicts and possibly other files which should be unique to each jail. I'm opening this issue to keep track of feature requests/improvements. I have no plans to implement this a.t.m. but contributions are welcome.

Instead you may create a config template. See the docker config template for inspiration (specifically the initial_setup bit):

github.com

Jip-Hop/jailmaker/blob/main/templates/docker/config

startup=0
gpu_passthrough_intel=0
gpu_passthrough_nvidia=0
# Turning off seccomp filtering improves performance at the expense of security
seccomp=1

# Use macvlan networking to provide an isolated network namespace,
# so docker can manage firewall rules
# Alternatively use --network-bridge=br1 instead of --network-macvlan
# Ensure to change eno1/br1 to the interface name you want to use
# You may want to add additional options here, e.g. bind mounts
systemd_nspawn_user_args=--network-macvlan=eno1
    --resolv-conf=bind-host
    --system-call-filter='add_key keyctl bpf'

# Script to run on the HOST before starting the jail
# Load kernel module and config kernel settings required for docker
pre_start_hook=#!/usr/bin/bash
    set -euo pipefail
    echo 'PRE_START_HOOK'

This file has been truncated. show original

To rename an existing jail you’d have to manually rename the dataset which was created for your jail inside the jails directory. Stop the jail first if it’s running then use the zfs rename command on the CLI.

Jip-Hop · May 3, 2024, 4:18pm

You can backup your jail using the features provided by TrueNAS. Such as snapshots and replication.

dasunsrule32 · May 3, 2024, 6:26pm

Just seeing if anyone has an answer for this. Thanks.

Jip-Hop · May 3, 2024, 7:25pm

Multiple jails can use the GPU simultaneously.

dasunsrule32 · May 3, 2024, 7:56pm

Sweet, thanks for confirming!

Stux · May 3, 2024, 10:15pm

Did you also specify the bridge instead of a NIC interface as well?