# Jailing services

Using FreeBSD jails involves two things, a service that creates/destroys a jail, and zero or more services that are then run in that jail. The external configuration import subsystem converts jails to this native form.

## Jail services

Jail services are a simple exercise in the use of the BSD `jail` command. The service's `start` program uses `jail -c` with its `persist` option to create a jail that keeps running even whilst it contains no processes. The service is marked as "ready after run" and "remain", and has a no-op `run` program that does nothing but exit. The service's `stop` program uses `jail -r` to remove the jail.

Thus a jail's lifetime is controlled by the start and stop of a service, which has no running process itself.

The various configuration settings for the `jail` command are exposed as service environment variables, accessible with the `rcctl` or the `set-service-env` and `print-service-env` commands.

## Jailed services

Services that run in a jail, jailed services, simply use the BSD `jexec` command in its chain-loading mode. They use it to move the current process, the dæmon itself, into a jail created and destroyed by a jail service.

They have `wants/` and `after/` relationships to the jail service. Because the jail service becomes ready after the jail is fully created, they do not run until there is a jail for them to switch themselves into; and starting them implicitly starts the service for the jail that they run in.