Quick Start

The project officially supports two primary runtimes. Choose the one that matches your background and requirements:

Both are first-class citizens in the Daemonless ecosystem, and it's safe to use both on the same host — they manage separate configuration and storage. Any other OCI-compatible tool with FreeBSD support should work too.

Podman#

pkg install podman-suite sysutils/podman-compose

# Load pf (required before setting pf sysctls)
kldload pf
sysrc kld_list+=pf
 
# Enable pf filtering for jails
sysctl net.pf.filter_local=1
echo 'net.pf.filter_local=1' >> /etc/sysctl.conf
 
# Mount fdescfs
mount -t fdescfs fdesc /dev/fd
echo 'fdesc /dev/fd fdescfs rw 0 0' >> /etc/fstab

ext_if=em0

# Podman container networking
rdr-anchor "cni-rdr/*"
nat-anchor "cni-rdr/*"
table <cni-nat>
nat on $ext_if inet from <cni-nat> to any -> ($ext_if)
nat on $ext_if inet from 10.88.0.0/16 to any -> ($ext_if)

pfctl -f /etc/pf.conf

sysrc podman_enable=YES
service podman start

podman run -d --name tautulli \
  -p 8181:8181 \
  -e PUID=1000 -e PGID=1000 \
  -v /path/to/containers/tautulli:/config \
  ghcr.io/daemonless/tautulli:latest

podman ps
podman logs -f tautulli

.NET applications need one more flag#

Apps like Radarr and Sonarr require the allow.mlock jail annotation:

podman run -d --name radarr \
  -p 7878:7878 \
  --annotation 'org.freebsd.jail.allow.mlock=true' \
  -e PUID=1000 -e PGID=1000 \
  -v /path/to/containers/radarr:/config \
  ghcr.io/daemonless/radarr:latest

Security model: host root ≠ container root#

If you're coming from Docker, "requires root on the host" might set off alarm bells — on Linux that can genuinely mean weaker isolation. On FreeBSD it doesn't, because host privilege and workload privilege are two separate axes:

1. Host privilege is an admin requirement, not a workload property. Podman/AppJail need root on the host to create and manage jails, the same way jail(8) itself always has, and the same way Docker's own daemon runs as root on Linux.
2. Daemonless images drop privileges immediately. The base image's s6 supervisor starts as root only long enough to do required setup (fixing /config ownership, etc.), then execs the application via s6-setuidgid bsd — dropping to an unprivileged user (UID:GID 1000:1000 by default, remappable via PUID/PGID) before the app itself starts.

The container boundary is a real FreeBSD jail — the same kernel-level isolation primitive jail.conf setups have used for two decades, not a namespace approximation of one.

Using ZFS#

If you're on ZFS, configure Podman to use it for copy-on-write layering and snapshot support:

zfs create -o mountpoint=/var/db/containers/storage <pool>/podman

See ZFS Storage for storage.conf tuning.

AppJail#

AppJail is the native FreeBSD alternative — unprivileged management via doas delegation, VNET networking, and deeper jail integration. It uses the same OCI images as Podman, deployed with appjail oci run or an appjail-director.yml descriptor instead of compose.yaml. See daemonless.io/guides/quick-start for the full AppJail walkthrough, including host configuration and the Director CLI.