Bastille

Bastille is an open-source system for automating deployment and management of containerized applications on FreeBSD. It builds on FreeBSD jails — the industry-standard containerization primitive, battle-tested in production for two decades — and wraps them in a fast, scriptable, security-first workflow.

If you’ve used Docker, the ideas will feel familiar: bootstrap a base, create lightweight containers, install packages, redirect ports, and template it all so it’s reproducible. The difference is that Bastille is native FreeBSD — no daemon, no dependencies, no magic. Just pkg, jails, ZFS, and pf.

Install

# Binary package (recommended)
pkg install bastille

# Enable containers to start at boot
sysrc bastille_enable=YES

Bastille is also available from the FreeBSD ports tree at sysutils/bastille, or you can track the bleeding edge from GitHub.

A container in under a minute

root@freebsd ~

bastille setup
bastille bootstrap 15.1-RELEASE update
bastille create alcatraz 15.1-RELEASE 10.17.89.50/24
bastille pkg alcatraz install -y nginx
bastille cmd alcatraz service nginx start

bastille setup configures the host once — networking, firewall, and storage — and everything after it is a fully isolated FreeBSD system running a web server, with its own process table, network stack, and package set.

What Bastille gives you

Hardened by default. Read-only root, sane pf firewall rules, and strong isolation applied from the moment a container is created.
Flexible networking. Portable loopback, bridged, and fully virtualized (VNET) networking with dynamic epair management and IPv4/IPv6 dual-stack.
Stackable templates. Bastillefile templates are like Dockerfiles for jails — composable, versionable, and shareable. Hundreds are maintained in the community template collection.
Target one, many, or all. Every subcommand can act on a single container, a list, or your whole fleet with a consistent syntax.
ZFS-native. Thin and thick jails, clones, snapshots, exports, and jailed datasets — all backed by ZFS when available.
Resource limits. Per-container CPU, memory, and disk quotas via rctl.

The command surface

Bastille exposes a focused set of subcommands that mirror the FreeBSD tools you already know — pkg, service, sysrc, cp, zfs — but scoped safely to your containers:

Lifecycle	Networking	Provisioning	Maintenance
`create` / `destroy`	`rdr` (port redirect)	`pkg`	`update` / `upgrade`
`start` / `stop` / `restart`	`network`	`service`	`etcupdate`
`clone` / `rename`	`setup`	`sysrc`	`verify`
`export` / `import`		`template`	`limits`
`migrate` (live)		`cp` / `cmd`	`zfs`

Run bastille --help for the full list, or dive into the official documentation.

Learn more

Getting Started guide — go from a fresh FreeBSD install to running containers in about twenty minutes.
Templates — automate anything from SSH to PostgreSQL to a full LAMP stack.
Documentation — complete reference for every subcommand.
Source on GitHub — issues, pull requests, and the roadmap.

Bastille is released under the BSD 3-Clause license. Found a bug? Open an issue.