FAQ

What is iocell?

A shell-based FreeBSD jail manager using ZFS, optional VNET networking and optional kernel resource limits. It needs uclcmd; it is not a zero-dependency tool.

What is a jail?

FreeBSD OS-level virtualization: isolated userlands share the host kernel. A jail is not a VM with an independent guest kernel.

What is VNET?

A separate per-jail networking stack. Shared-IP jails instead use selected addresses on host interfaces. Set the mode explicitly when following an example because capable hosts enable VNET automatically.

How do I configure addresses?

Use ip4_addr or ip6_addr with interface|address/prefix. The interface is a host interface for shared IP and a jail interface for VNET. See Networking.

Do I need a default gateway?

VNET jails need appropriate routes for destinations off their attached network. The gateway may be the host’s private bridge address when the host is configured as a router/NAT gateway, or another router. Shared-IP jails use the host network stack rather than a separate jail gateway.

Does iocell configure NAT?

No complete host NAT policy is set up automatically. Configure FreeBSD routing and firewall/NAT rules for your topology. Do not expose additional MAC addresses on a provider link that prohibits them.

Can I run a firewall in a jail?

Availability depends on VNET, the host kernel, jail permissions and device exposure. Do not apply an old blanket PF/IPFW or securelevel recipe to all host versions. Keep host filtering and management access while testing rules on an isolated network.

Can I use templates and clones?

Yes. Use istemplate=yes/no for conversion and clone for deployment. Template tags must be safe ZFS components. See How to create and use templates and Jail types.

Are clones independent?

A ZFS clone depends on its source snapshot. Promotion reverses that relationship. Shared basejail release mounts remain shared; promotion alone does not turn them into a private full OS installation.

Can I limit CPU and memory?

Yes, with appropriate kernel support and RACCT enabled at boot. Configure rlimits=on and desired properties, then inspect actual rules with limits and resource use with inuse. See Advanced usage.

Can I use short UUIDs?

See the identity and import-selector restrictions in Known limitations.

Where is configuration stored?

In UCL files under the selected iocell dataset, plus native ZFS properties. defaults displays defaults. set property=value default saves creation defaults; explicit create properties override them. Existing jails are not rewritten. See Basic usage for managed-field exclusions.

Can I run without a ZFS pool?

No. The host OS itself need not be installed on ZFS, but iocell requires a usable pool for jail storage.

How do I keep iocell from managing my bridges?

Prepare the bridge yourself and use createbridge=off and keepbridge=on as appropriate. See Networking.

What should I back up before updates?

Back up jail configuration and data, plus the shared release used by basejails. Stop or quiesce applications for consistent backups. See Best practices and Known limitations for storage boundaries.