Chris - VNET

Hey there Allan and Kris,

First off I just wanted to say that MeetBSD was a really great experience. Everyone was so friendly and encouraging. Your TrueOS talk got me pretty excited about what's here and what's coming, so much so that I'm going to install it on my x260 over the Thanksgiving break and forego suspend/resume support in exchange for cool things like ZFS, GELI, and LibreSSL. The ZFS breakout discussion and hacker lounge were great places to ask people questions and hangout as well. I had so much fun at MeetBSD that I'm pretty strongly considering registering for BSDCan next year.

My question is about the motivation behind VNET or VIMAGE jails. After watching the talk on Jail Networking I felt compelled to try isolating some services on my server within separate jails. I'm also considering hosting a friend's website within a jail on my DigitalOcean droplet. From what I can tell, I can either setup multiple shared IP jails and put them behind a NAT with the help of PF, or I can set up multiple VNET jails which get networking through a bridge.

I've read that VNET jails are currently experimental. Would you recommend using them over shared IP jails? Is there a benefit for the extra network virtualization? If there is, is it worth using if the jails are only going to be running programs like nginx, PHP, and MySQL?

Thanks again for the great show,

Chris