3

Question

I want to separate PHP (PHP-FPM) and Nginx into different jails. One jail with Nginx, and one with PHP-FPM / PHP / Wordpress.

Nginx is good at serving static assets, so I would like to serve those directly with Nginx. How can I mount a folder from one jail into another jail (read-only)?

I also have a Nodejs app in another jail, so I would also like to serve the static assets of it directly with Nginx.

Side question: When you host multiple PHP sites on the same server. Do you have to install PHP / PHP-FPM in each jail if you want each web-app in each own jail?

Info

  • Version: FreeBSD 10.2
  • Filesystem: root on ZFS

Sources

I have found this blog on using mount_nullfs for it. But can you use it between jails instead of between the host and a jail?

  • You can use hard links (assuming both jails are on the same partition/filesystem) to make one directory accessible via multiple jails. – chander Dec 15 '15 at 15:39
  • You mean, hard link the directory from the host to both jails? – blablabla Dec 15 '15 at 16:04
3

nullfs can be used to give a jail read-only access to parts of the host's file system. All the jails live within the host's file system, so the idea of jail-to-jail access is moot.

On my system (and I do jails the hard way) I have the following directive in /etc/jails.conf:

mount.fstab = "/etc/fstab.${name}";

which means I have separate fstabs for each jail, which then contains something like:

/jail/base /jail/somejail/base nullfs ro 0 0

There is obviously a whole range of arguments regarding the partitioning of jails, processes and applications. Personally, I like to keep an application self contained within a single jail, then use (yet another) nginx jail to reverse-proxy to all of the application jails. Using ZFS and one application per jail makes it very easy to manage different versions of the stack simultaneously, test new versions, and roll-back where necessary. In summary, I advocate running nginx and php-fpm in each application jail (that contain both static and dynamic content).

  • I'm using ezjail because I'm just starting out using jails. But I could add the mount rules to the general fstab this way. Thanks! – blablabla Dec 15 '15 at 21:01
  • Doesn't the extra nginx instance make it that requests take relatively longer to load for the browser? – blablabla Dec 15 '15 at 21:02
  • To improve performance you would allow the front-end to cache. – Richard Smith Dec 15 '15 at 21:07
  • I see ezjail creates an fstab for each jail in /etc. So I can add the mounts for each jail. (/etc/fstab.www) – blablabla Dec 16 '15 at 8:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.