Cells for NetBSD – Kernel-enforced, jail-like Isolation with User-friendly Operations

by

This section demonstrates a minimal, reproducible workflow with current
cellmgr command surface.

The example bootstraps the host, creates the desired cell manifest for a simple HTTP service, adds a declarative apply scheme, changes the runtime state, and verifies that the cell is running.

1. Bootstrap Host Integration

Initiate host integration, prepare base layers, and verify that required kernel/runtime prerequisites are present.

vhost# cellmgr system bootstrap

2. Create the desired cell manifest

Create a desired-state manifest for an HTTP workload. writes configuration into /etc/cellmgr Only (--scope desired) and the service has not started yet.

vhost# cellmgr cell create mysite-edge-httpd \
  --autostart YES \
  --profile medium \
  --reserved-ports 8080 \
  --log-facility local1 \
  --stdout-level info \
  --stderr-level err \
  --log-tag cell-mysite-edge-httpd \
  --cmd '/usr/libexec/httpd -I 8080 -X -f -s /var/www/mysite-edge-httpd' \
  --healthcheck 'test -f /var/www/mysite-edge-httpd/index.html' \
  --scope desired
Created manifest /etc/cellmgr/mysite-edge-httpd.cell

3. Add Declarative Enforced Plan

Define a small implementation plan that creates the initial web content inside the cell. Plans are declarative, versionable, and executable cellmgr apply During reconciliation.

vhost# vi /etc/cellmgr/mysite-edge-httpd.apply

Planning Contents:

FILE_BEGIN /var/www/mysite-edge-httpd/index.html

        Hello NetBSD

FILE_END

4. Desired convergence to runtime

Run reconciliation to present runtime state from the manifest, execute the apply plan, start supervised service processes, and run configured health checks.

vhost# cellmgr apply
apply: dry-run=NO reapply=NO restart-changed=NO verbose=NO
cell mysite-edge-httpd
  CREATE       render runtime cell state
  APPLY        run /etc/cellmgr/mysite-edge-httpd.apply
  START        supervised service after apply
  HEALTHCHECK  test -f /var/www/mysite-edge-httpd/index.html
  RESULT       changed

summary: cells=1 changed=1 failed=0 dry-run=NO

5. Verify runtime status

Inspect the Live Cell view and confirm that the instance is running with the specified CID and increasing age.

vhost# cellmgr cell list -o name,running,cid,age
NAME               RUNNING  CID  AGE
mysite-edge-httpd  YES      1    31s

6. Open the service

Verify the HTTP endpoint from your client or browser:

http://vhost.local:8080/

7. Export Prometheus-Compatible Metrics

cellctl stats -P -h Emits Prometheus text format with minimal HTTP headers. it can be wired inetd For very lightweight metrics endpoints without additional exporter software.

vhost# cellctl stats -P -h
HTTP/1.1 200 OK
Content-Type: text/plain

# TYPE cell_cpu_ticks_1s gauge
# TYPE cell_cpu_ticks_10s_avg gauge
# TYPE cell_processes_current gauge
# TYPE cell_references_current gauge
# TYPE cell_memory_vmsize_bytes gauge
# TYPE cell_age_seconds gauge
cell_cpu_ticks_1s{cid="2",name="mysite-edge-httpd",root="/var/cellmgr/cells/mysite-edge-httpd/root"} 0
cell_cpu_ticks_10s_avg{cid="2",name="mysite-edge-httpd",root="/var/cellmgr/cells/mysite-edge-httpd/root"} 0
cell_processes_current{cid="2",name="mysite-edge-httpd",root="/var/cellmgr/cells/mysite-edge-httpd/root"} 1
cell_references_current{cid="2",name="mysite-edge-httpd",root="/var/cellmgr/cells/mysite-edge-httpd/root"} 1
cell_memory_vmsize_bytes{cid="2",name="mysite-edge-httpd",root="/var/cellmgr/cells/mysite-edge-httpd/root"} 137601024
cell_age_seconds{cid="2",name="mysite-edge-httpd",root="/var/cellmgr/cells/mysite-edge-httpd/root"} 596

next steps

For in-depth operational guides and reference material, continue to the Documentation.

The docs are still being created, but they already contain refined end-to-end recipes, including a MantisBT 3-tier setup (three cells, multiple volumes) and a Luanti gameserver instance.



<a href

Leave a Comment