AppJail

Spec sheet

What it does

AppJail is an open-source BSD-3 licensed framework for creating isolated, portable environments using FreeBSD jails.Read 9 Oct 2026 · appjail.readthedocs.io

Purpose

AppJail is an open-source BSD-3 licensed framework for creating isolated, portable environments using FreeBSD jails.Read 9 Oct 2026 · appjail.readthedocs.io

Intended users

The project says its goal is to simplify jail workflows for sysadmins and developers.Read 9 Oct 2026 · appjail.readthedocs.io

Audience

The project says it aims to simplify jail workflows for system administrators and developers.Read 9 Oct 2026 · appjail.readthedocs.io

Support

The project repository links to a support page for users who need help with AppJail.Read 9 Oct 2026 · github.com

Application deployment

Makejail files automate jail creation by generating an InitScript and a BuildScript.Read 9 Oct 2026 · appjail.readthedocs.io

Experimental feature

TinyJails are described as experimental stripped-down jails intended to be useful for distribution.Read 9 Oct 2026 · appjail.readthedocs.io

Installation

AppJail can be installed from source, as the sysutils/appjail-devel port, or as the sysutils/appjail package.Read 9 Oct 2026 · appjail.readthedocs.io

Jail features

It supports thin and thick jails, jail dependencies, startup ordering, and parallel startup of healthcheckers, jails, and NAT.Read 9 Oct 2026 · appjail.readthedocs.io

Language

AppJail is written in POSIX shell and C.Read 9 Oct 2026 · appjail.readthedocs.io

Linux jails

Linux distributions can run in jails for isolated applications unavailable in the FreeBSD ports collection, and this method requires debootstrap.Read 9 Oct 2026 · appjail.readthedocs.io

Monitoring

Healthcheckers can monitor a jail, its services, or other targets the user specifies.Read 9 Oct 2026 · appjail.readthedocs.io

Networking

Features include NAT, port forwarding, IPv4 and IPv6, virtual networks, bridges, VNET, DHCP, and SLAAC.Read 9 Oct 2026 · appjail.readthedocs.io

Notable limitation

TinyJails are identified as experimental, and raw-image jail backups require ZFS.Read 9 Oct 2026 · appjail.readthedocs.io

OCI compatibility

AppJail supports deploying OCI-compatible container images in environments such as FreeBSD jails.Read 9 Oct 2026 · appjail.readthedocs.io

OCI integration

AppJail supports deploying OCI-compatible containers into FreeBSD jails; its OCI command requires buildah and jq.Read 9 Oct 2026 · appjail.readthedocs.io

Secrets

AppJail documents encrypted secrets on disk and unencrypted secrets in a non-swap-backed in-memory filesystem, mounted read-only for jails by the recommended option.Read 9 Oct 2026 · appjail.readthedocs.io

Secrets limit

The default in-memory filesystem size for secrets is 32 MiB, and the documentation advises increasing it for larger needs or using disk encryption for larger blobs.Read 9 Oct 2026 · appjail.readthedocs.io

Storage and limits

It supports UFS, ZFS, and RACCT/RCTL resource limits.Read 9 Oct 2026 · appjail.readthedocs.io

Storage and networking

Documented capabilities include UFS and ZFS, NAT, port forwarding, IPv4 and IPv6, virtual networks, bridges, and VNET.Read 9 Oct 2026 · appjail.readthedocs.io

Unprivileged use

The handbook recommends allowing unprivileged users to run AppJail through a configured privilege tool such as doas, sudo, or FreeBSD's mdo.Read 9 Oct 2026 · appjail.readthedocs.io

Where Specifiction places it

• Container Engines#16 of 317.5