November 7, 2025

Docker vs BSD: choose your fighter

Immutable Software Deploys Using ZFS Jails on FreeBSD

FreeBSD fans cheer instant undo; skeptics shout "Docker with extra steps"

TLDR: A guide ships apps on FreeBSD by cloning fresh jails (safe sandboxes) from snapshots for instant rollbacks, while Caddy flips traffic to healthy versions. Comments split: use Docker/jail managers vs DIY control; the draw is zero downtime, clean upgrades, and predictable rollbacks.

FreeBSD just dropped a very opinionated playbook for “immutable” app deployments: spin up fresh mini-systems (called jails) from ZFS snapshots (ZFS is a storage system that keeps super-fast “freeze frames” of your files), then let Caddy switch traffic to the healthy one. Translation: instant rollbacks, zero‑downtime upgrades, and a clean reset every release. Sounds neat… but the comments came in HOT. The top reply basically went “Isn’t this just Docker with extra steps?”, kicking off the classic showdown: click-and-go convenience vs BSD’s DIY pride. The FreeBSD crowd clapped back with “we’re using base OS tools, thanks,” while others suggested easier routes like jail managers—“press fewer buttons, get the same result,” as one put it, pointing to tools that automate jails. Meanwhile, old-school BSD fans dropped receipts, praising ezjail (“been doing this for years, works great”) and linking docs like the FreeBSD Jails Handbook. And then there’s the builder energy: one commenter flexed a custom reverse proxy that auto-configures over RPC, even acting as its own mini certificate authority for encrypted internal traffic. Cue the memes: “BSD users be like: why use a toaster when you can rebuild the sun,” versus “Docker people: I like my buttons.” Love it or roast it, the takeaway is clear—this guide makes rollbacks and upgrades boringly reliable, and the community can’t decide if that’s genius or overengineered.

Key Points

  • Immutable deployments are achieved by cloning ZFS snapshots into new FreeBSD jails for each release.
  • Caddy v2 serves as a reverse proxy with TLS and health checks, routing traffic to the healthy jail for zero‑downtime upgrades.
  • Host setup includes creating a lo1 loopback interface on 172.16.0.0/12 via an rc.d service and enabling jails with parallel start.
  • Jail configuration is centralized in /etc/jail.conf with per‑jail files included from /etc/jail.conf.d/*.conf.
  • A base image template is built from FreeBSD base.txz, patched with freebsd-update, and snapshot for reuse via ZFS clones.

Hottest takes

"Isn't this just docker with extra steps?" — fukka42
"This can be done with 'less effort' by using a jail manager" — soupbowl
"I have a reverse proxy that auto configures and acts as a CA root" — fsmv
Made with <3 by @siedrix and @shesho from CDMX. Powered by Forge&Hive.