> For the complete documentation index, see [llms.txt](https://book.bsdcn.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://book.bsdcn.org/di-31-zhang-linux-jail/di-31.3-jie-ubuntu-jail.md).

# 31.3 Ubuntu Jail

Ubuntu Jail 的创建方法与 Debian 相同，以 Ubuntu 22.04（Jammy）为例。

## 构建基本系统

创建 Ubuntu Jail 根目录并使用 debootstrap 安装系统：

```sh
# 创建 Ubuntu Jail 根目录
# mkdir -p /usr/jails/ubuntu

# 使用 debootstrap 安装 Ubuntu Jammy 系统到 Jail，并指定镜像源
# debootstrap jammy /usr/jails/ubuntu https://mirrors.ustc.edu.cn/ubuntu/
```

## 管理挂载文件

创建 **/etc/fstab.ubuntu** 文件，内容如下：

```ini
devfs      /usr/jails/ubuntu/dev      devfs       rw                      0  0
tmpfs      /usr/jails/ubuntu/dev/shm  tmpfs       rw,size=1g,mode=1777    0  0
fdescfs    /usr/jails/ubuntu/dev/fd   fdescfs     rw,linrdlnk             0  0
linprocfs  /usr/jails/ubuntu/proc     linprocfs   rw                      0  0
linsysfs   /usr/jails/ubuntu/sys      linsysfs    rw                      0  0
/tmp       /usr/jails/ubuntu/tmp      nullfs      rw                      0  0
```

## 管理 Jail 配置文件

在 **/etc/jail.conf** 文件中写入 Ubuntu 的配置：

```ini
ubuntu {                               # Jail 名称
  host.hostname = "ubuntu";             # 设置 Jail 的主机名
  mount.fstab = "/etc/fstab.ubuntu";    # Jail 使用的 fstab 文件
  path = "/usr/jails/ubuntu";           # Jail 根目录路径
  devfs_ruleset = 4;                     # devfs 挂载规则集
  enforce_statfs = 1;                    # 设置挂载点可见性
  allow.mount;                          # 允许挂载文件系统
  allow.mount.devfs;                     # 允许挂载 devfs
  exec.start = "/bin/true";              # 启动时执行的命令
  exec.stop = "/bin/true";               # 停止时执行的命令
  persist;                               # 即使无进程也保持 Jail 存活
  allow.raw_sockets;                      # 允许使用 raw Socket
  interface = "lo1";                      # 指定网络接口
  ip4.addr = 192.168.5.2;                 # 分配 IPv4 地址
  ip6 = "disable";                        # 禁用 IPv6
}
```

## 允许网络访问

在 pf 防火墙中的 `jails` 表中加入 Jail 的地址，以允许 Jail 访问网络：

```sh
# pfctl -t jails -T add 192.168.5.2
```

## 启用 Ubuntu Jail 实例

启用实例：

```sh
# jail -c ubuntu
```

如果已经在文件 **/etc/rc.conf** 中设置过 `jail_enable=YES`，也可用：

```sh
# service jail start ubuntu
```

开机启动的设置方法可参考 Debian Jail，执行以下命令将 Jail ubuntu 加入启动列表：

```sh
# sysrc jail_list+=ubuntu
```

## 更新 Ubuntu 系统

过程与 Debian Jail 相同，只需将命令中的 `debian` 替换为 `ubuntu`。参考本书其他相关章节。

## 参考文献

* FreeBSD 中文手册. 12.3. Linux 用户空间\[EB/OL]. \[2026-03-25]. <https://handbook.bsdcn.org/di-12-zhang-linux-er-jin-zhi-jian-rong-ceng/12.3.-linux-yong-hu-kong-jian.html>. 中文手册中关于构建完整 Linux 用户空间环境的教程。
* Ubuntu Documentation. Install Firefox on Linux\[EB/OL]. \[2026-04-17]. <https://support.mozilla.org/en-US/kb/install-firefox-linux>. Firefox 在 Ubuntu 22.04 中默认以 snap 分发，也可通过 PPA 以 deb 包安装。


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://book.bsdcn.org/di-31-zhang-linux-jail/di-31.3-jie-ubuntu-jail.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.