> For the complete documentation index, see [llms.txt](https://book.bsdcn.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://book.bsdcn.org/di-31-zhang-linux-jail/di-31.5-jie-alpine-jail.md).

# 31.5 Alpine Jail

## 创建 Alpine Jail 基本系统

构建基本系统：

```sh
# 下载 Alpine Linux 3.17.1 minirootfs 镜像
# fetch https://mirrors.ustc.edu.cn/alpine/v3.17/releases/x86_64/alpine-minirootfs-3.17.1-x86_64.tar.gz

# 创建 Alpine Jail 根目录
# mkdir -p /usr/jails/alpine

# 解压 minirootfs 到 Jail 根目录
# tar zxf alpine-minirootfs-3.17.1-x86_64.tar.gz -C /usr/jails/alpine/

# 创建必要的设备节点
# touch /usr/jails/alpine/dev/shm
# touch /usr/jails/alpine/dev/fd
```

## 管理挂载文件

创建 **/etc/fstab.alpine** 文件。其中 **/tmp** 挂载已被注释，避免将整个宿主机 **/tmp** 目录暴露给 Jail，以提高安全性：

```ini
devfs      /usr/jails/alpine/dev      devfs       rw                      0  0
tmpfs      /usr/jails/alpine/dev/shm  tmpfs       rw,size=1g,mode=1777    0  0
fdescfs    /usr/jails/alpine/dev/fd   fdescfs     rw,linrdlnk             0  0
linprocfs  /usr/jails/alpine/proc     linprocfs   rw                      0  0
linsysfs   /usr/jails/alpine/sys      linsysfs    rw                      0  0
#/tmp       /usr/jails/alpine/tmp      nullfs      rw                      0  0  # 注释掉可避免将整个宿主机 /tmp 目录暴露给 Jail
```

## 管理 Jail 模板

在 **/etc/jail.conf** 文件中写入：

```ini
alpine {                               # Jail 名称
  host.hostname = "alpine";             # 设置 Jail 的主机名
  mount.fstab = "/etc/fstab.alpine";    # Jail 使用的 fstab 文件
  path = "/usr/jails/alpine";           # Jail 根目录路径
  devfs_ruleset = 4;                     # devfs 挂载规则集
  enforce_statfs = 1;                    # 设置挂载点可见性
  allow.mount;                          # 允许挂载文件系统
  allow.mount.devfs;                     # 允许挂载 devfs
  exec.start = "/bin/true";              # minirootfs 中未初始化系统，暂时使用 /bin/true，后续会设置 openrc
  exec.stop = "/bin/true";               # 停止时使用 /bin/true
  persist;                               # 即使无进程也保持 Jail 存活
  allow.raw_sockets;                      # 允许使用 raw Socket
  interface = "lo1";                      # 指定网络接口
  ip4.addr = 192.168.5.4;                 # 分配 IPv4 地址
  ip6 = "disable";                        # 禁用 IPv6
}
```

设置开机时启动，随后立即启动：

```sh
# sysrc jail_list+="alpine"
# jail -c alpine
```

## 防火墙放行网络

在 pf 防火墙中允许网络访问，与前述方法相同：

```sh
# pfctl -t jails -T add 192.168.5.4
```

## 为基本系统配置 OpenRC

进入 Jail。minirootfs 仅提供基础环境，安装 OpenRC 可获得完整的服务管理能力：

```sh
freebsd # jexec alpine /bin/sh        # 初始仅有 sh，请留意 Shell 提示符的变化
alpine # sed -i 's/dl-cdn.alpinelinux.org/mirrors.ustc.edu.cn/' /etc/apk/repositories    # 修改镜像地址
alpine # echo 'nameserver 223.5.5.5' >> /etc/resolv.conf      # 初始没有此文件，需自行创建
alpine # apk update             # minirootfs 可直接运行程序，但无法管理服务，需安装 OpenRC 以获得完整的服务管理能力
alpine # apk add openrc         # 安装 OpenRC 作为初始化系统
alpine # mkdir /run/openrc  # 创建 OpenRC 运行目录
alpine # touch /run/openrc/softlevel      # 在 Docker、Chroot 或 Jail 环境中使用 OpenRC 时建议创建此文件
alpine # exit    # 留意 Shell 提示符的变化
FreeBSD # jail -r alpine    # 先关闭 Alpine Jail，以便在 FreeBSD 宿主机中配置 OpenRC
```

修改 **/etc/jail.conf** 文件中 Alpine 的配置：

```ini
alpine {                               # Jail 名称
  host.hostname = "alpine";             # 设置 Jail 的主机名
  mount.fstab = "/etc/fstab.alpine";    # Jail 使用的 fstab 文件
  path = "/usr/jails/alpine";           # Jail 根目录路径
  devfs_ruleset = 4;                     # devfs 挂载规则集
  enforce_statfs = 1;                    # 设置挂载点可见性
  allow.mount;                          # 允许挂载文件系统
  allow.mount.devfs;                     # 允许挂载 devfs
  exec.start = "/sbin/openrc default";   # 使用 OpenRC 初始化系统，启动 default 运行级别
  exec.stop = "/sbin/openrc shutdown";   # 使用 OpenRC 初始化系统，执行 shutdown 运行级别任务
  persist;                               # 即使无进程也保持 Jail 存活
  allow.raw_sockets;                      # 允许使用 raw Socket
  interface = "lo1";                      # 指定网络接口
  ip4.addr = 192.168.5.4;                 # 分配 IPv4 地址
  ip6 = "disable";                        # 禁用 IPv6
}
```

重启 alpine Jail：

```sh
# jail -c alpine
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://book.bsdcn.org/di-31-zhang-linux-jail/di-31.5-jie-alpine-jail.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.