deploy multiple vnets with VIMAGE/VNET + Production Ready?

[Roger Marquis]

Ernie Luzar wrote:
> the kernel to included vimage. Enabling pf or ipf firewalls cause the
> host to crash. ipfw firewall does not cause a crash but has next to no
> real life usage on vimage.

Considering we have had ipfw/vimage/netgraph jails for several years I'd
be interested in your data sources.

> When stopping vimage jails there is a problem with memory loss.

Have you tested this, on a recent release?

> You need a high proficiency in coding netgraph which
> is used to tie the hosts network to each vimage jail.

This certainly used to be true and IMO has been a significant barrier to
netgraph usage but the scripts in head/share/examples/jails/ are
at least helpful.

> Needs a public network with multiple static ip address & registered domain
> names even to test it.

How are you implementing vimage that needs a registered domain name?

> There are a few write ups about how to configure vet/vimage jails, but
> their out of date. IE: 8.x & 9.x releases which are at EOL [end of life,
> unsupported].

Vimage gets little attention.  Unfortunately the mapping of non-vimage
localhost interfaces to the primary external interface isn't noted 
nearly enough either.  These are weaknesses in bsd jails, the latter a
non-trivial security issue on many non-vimage systems considering
daemons like sendmail are installed and listening on "localhost" by
default.

> Going down this road will make the shop totally dependent on you and your
> ability. A mega size pay bump is in your future. The shop will be fubar-ed
> if you die or get hurt requiring a hospital stay and long recovery.

Potentially true of any Unix or Linux application in my experience.
Have you tried vimage with epair/if_bridge instead of netgraph?  It's
considerably simpler though the documentation is almost as conflicting
and insufficient.

Roger