← Back to Blog

February 19, 2026 · Engineering

BSDulator Phase 3: VNET Networking is Live

Phase 3 of BSDulator development is complete. The headline feature: virtual network isolation using Linux network namespaces to emulate FreeBSD's VNET functionality.

How VNET Works in Lochs

When you create a jail with the vnet parameter, BSDulator:

1. Creates a Linux network namespace (/var/run/netns/bsdjail_<jid>)
2. Creates a veth pair — veth0_j<jid> on the host, eth0 inside the jail's namespace
3. Attaches the host end to a bridge interface (bsdjail0 at 10.0.0.1/24)
4. Assigns the requested IP to eth0 inside the jail namespace
5. Sets up a default route through the bridge gateway

Host System
+-------------------------------------------------+
|  bsdjail0 (bridge) - 10.0.0.1/24               |
|     |                                           |
|     +-- veth0_j1 <--> eth0 (jail1 netns)       |
|     |                  10.0.0.10/24             |
|     |                                           |
|     +-- veth0_j2 <--> eth0 (jail2 netns)       |
|                        10.0.0.20/24             |
+-------------------------------------------------+

What We Verified

Full host-to-jail connectivity: ping 10.0.0.10 from the host reaches the jail. Full jail-to-jail connectivity: ip netns exec bsdjail_1 ping 10.0.0.20 works. Cleanup on jail removal properly tears down the veth pair, removes the namespace, and detaches from the bridge.

Also in Phase 3

• IP address assignment: ip4.addr parameter parsing in jail_set() with support for multiple comma-separated IPs
• Enhanced jls: Verbose output with cpuset.id, proper IP display
• Enhanced jexec: -l login shell flag, -U/-u user flags (parsed, credential handling via credsync syscall 596)
• FreeBSD 15 syscalls: __realpathat (574, stub) and credsync (596, emulated)
• Compatibility checker: scripts/check_compat.sh verifies kernel version, namespace support, ptrace availability, required commands, and networking setup

Usage

# Create jail with virtual network
sudo ./bsdulator ./freebsd-root/libexec/ld-elf.so.1 \
    ./freebsd-root/usr/sbin/jail \
    -c name=myjail path=./freebsd-root ip4.addr=10.0.0.10 vnet persist

# Verify connectivity
ping 10.0.0.10

# List jails
sudo ./bsdulator ./freebsd-root/libexec/ld-elf.so.1 \
    ./freebsd-root/usr/sbin/jls -v

# Execute in jail
sudo ./bsdulator ./freebsd-root/libexec/ld-elf.so.1 \
    ./freebsd-root/usr/sbin/jexec 1 /bin/sh

# Clean removal
sudo ./bsdulator ./freebsd-root/libexec/ld-elf.so.1 \
    ./freebsd-root/usr/sbin/jail -r 1