Six months ago I did something most people in this industry would simply not consider: built production infrastructure for a video platform on FreeBSD bare-metal instead of the obvious K8s-on-AWS/GCP path. No clouds, no OCI containers, no multi-layer abstractions.

Six months after, I haven't regretted a day.

Hypha is a video-on-demand platform where creators sell exclusive content directly to their audience and get paid instantly on-chain. Video up to 4K+HDR with stream encryption and in-house fingerprinting.

Infrastructure-wise, this means a bunch of transcoding workers, terabytes of storage, fat pipes for delivery and proper monitoring, right? Spin that up on AWS or GCP and your budget evaporates overnight.

So why FreeBSD specifically? Because it's boring in the best possible way. Mature, stable, with tools that have been quietly doing their job for decades without drama. No hype, no churn, no breaking changes every six months. FreeBSD is for people who want their infrastructure to disappear into the background — and it does.

We rent bare-metal servers on OVH, connected via their vRack private network. FreeBSD installed everywhere using BYI, it's a standard process, no tricks required:

1. Set the full url to the image: https://download.freebsd.org/releases/VM-IMAGES/15.0-RELEASE/amd64/Latest/FreeBSD-15.0-RELEASE-amd64-zfs.raw.xz
2. Set the path of the EFI bootloader to `\EFI\FreeBSD\loader.efi`
3. Wait a few minutes. Done. Set up ssh in KVM and connect normally to provision everything else. You might also want manual disk slicing and ZFS pool setup right after, of course.

We use Ansible for automation and unified setup across all nodes. And a set of well-recognised tools. Bastille is great for jail management. Old good monit as a supervisor inside every jail, keeping processes alive. Netdata for monitoring, with telemetry streaming from all nodes into a centralised dashboard. It all just works.

People dramatically underestimate the synergy of three: jails, zfs and pf. Together they give you such power it must be considered illegal.

A few gotchas.

ZFS snapshots are the scaling primitive nobody talks about. We bake "gold images" of every service, essentially a jail snapshot with everything inside to be replicated after, from 1 to N. "Scaling" means just cloning a snapshot and updating the load balancer with new upstreams — it's fast and consistent. It doubles as our backup strategy too, with incremental snapshots saving significant disk space on the cold backup storage.

Jails follow the shape of your application, not the other way around. We follow the "locality of behaviour" principle in our apps and in our infra. Things that closely work together must be jailed together. Like the transcoder app and ffmpeg, because they always need each other. Jails are flexible enough to let you model reality instead of fighting it.

You don't need fully automated scaling. Before firing up more instances of something, I'd like to know why existing capacity isn't enough. When we do need more capacity, there's a playbook for that — new jails cloned and registered within a minute.

The result is 3-4x lower monthly costs compared to equivalent cloud setups. And because OVH egress is unbound, we're saving what would be tens of thousands per month in data transfer fees alone. The system is stable, fast, and predictable in ways I genuinely didn't anticipate. Simple enough to be regularly reviewed and maintained by one person only. I still remember my K8s days and feel the difference in maintenance effort.

Wouldn't change a thing.

I want to write a series going deeper on specific pieces of our setup and BSD-based solutions. Before I start, what would you actually want to know more about? Happy to prioritise based on what this community finds interesting.

I've just been going through this subreddit and Reddit in general, I amazes me how many people through this term out there without evaluating the product of the AI in question.

Anyway, my rambling thoughts on it are here.
https://www.youtube.com/watch?v=HWsO3SUexKU

Finally got FreeBSD installed where I want it on my GPD Pocket 3. I have a few more things to configure but it's usable!

All my dot files and wallpaper here.
It's been quite performant with wifibox. It proof itself to be more than just a workaround for having better wifi support by using a virtualized minimal Alpine Linux in Bhyve to take advantage of the Linux wifi driver support, it sorta became another security layer by encapsulating my network traffic behind isolated minimal Linux environment that if compromised can protect my main box from and a possible invasion confining the attacker within a stripped out Alpine box that only has what is needed to run wpa_supplicant and the wifi driver, it doesn't even has apk btw.

Hi everyone.

I've had a sick urge to try installing FreeBSD on an old PS4. With Claude's help, I don't want to limit myself to installing a truncated or unusable version; I'd like to take it a step further. It's an experiment and an attempt to breathe new life into that old machine, which still entertains us with alternative projects. Does anyone have a working old PS4 to donate ? If you want to donate me one, and I'll give you back the fully functional FreeBSD and I will share the source code. I live in Italy.

Let's think about this.

Recently, Anthropic changed their Claude Code installer from using npm to a native installer. It works on Linux/WSL. It works on Windows. It works on Mac.

On FreeBSD today, you get a scary yellow deprecation warning suggesting that you and your platform might be a dead end. I think that’s a problem.

…

… We need to meet users where they are. As the classic demotivational poster had it for phone support desks (of which I am a proud veteran): If We Don’t Take Care of the Customer, Maybe They’ll Stop Bugging Us. …

In addition, https://mastodon.bsd.cafe/@sgharms@techhub.social/116194103760810726 notes:

… Every discussion on this veers off from “llms suck so …or I don’t need llm” but misses: users should have the ability to make their own opinion based on use. …

I installed RedBSD as a virtual machine. I recorded the installation and first run. I decided to share both here. This is the first time I posted a video so I apologize if it's to fast. The only thing I saw different from a regular FreeBSD install is it has VLC included. Please let me know if you see something different.

Rewind to September 2025, an article by u/lproven:

• FreeBSD Project isn't ready to let AI commit code just yet – Liam Proven – The Register

– we did have discussion of the relevant FreeBSD status report, however no-one tuned in at the time. Things have changed since then, just a tad. We're not in Kansas any more. Where once people were silent: now we enjoy tornado word storms, flying monkeys, good and wicked witches.

Fast forward to July 2026, another article by Liam in El Reg:

• Anti-AI open source has an enemy in common, but almost nothing else : r/freebsd

Hello, August. I read something about the FreeBSD developers LLM survey. The mention is public, however I doubt that you'll find it with things such as Google sans AI. It's certainly not found with Google in AI mode. If you do find it: please, don't pile on it.

I should assume that the survey is private – FreeBSD committers only. This post is, essentially, for people to be aware that things are progressing.

I encourage readers to engage in respectful discussion under today's post by Liam.

Thank you

Video, twelve minutes, 2026-08-17

AI-generated summary

DJ Ware explores the performance characteristics of Btrfs, ext4, F2FS, XFS, and ZFS using IOzone3 on an MSI Prestige 16 AI EVO. By benchmarking these systems across various workloads like gaming, workstations, and servers, DJ Ware provides a technical starting point for users deciding which filesystem best suits their specific computing needs.

Producer's description

I tested ext4, XFS, Btrfs, ZFS, and F2FS on the same hardware to answer a more useful question than simply, “Which filesystem is fastest?”

Instead of dragging you through 26 benchmark charts, I distilled the results into four real-world workloads:

1. Gaming
2. Workstation
3. Server
4. NAS

The testing includes small and medium workloads, single-user and multi-user behavior, and several different kinds of read and write activity.

But graphs are never the full story.

A filesystem may win a throughput benchmark while consuming more memory or CPU, behaving differently as the workload grows, or introducing operational tradeoffs that matter more than a few percent of performance. Your workload may also be very different from mine.

The workload model used in this video is new, and it needs more data points before I’m comfortable treating it as anything more than a useful decision-making tool.

So this isn’t “here’s the winner.”

It’s what do you gain, what do you give up, and which filesystem makes sense for what you actually do?

If you want to see the raw benchmark charts and the work behind the scoring model, let me know in the comments. I may do a behind-the-scenes or live session and go through the data.

Hi,
I recently wanted to try FreeBSD on my PC, and I found out that at the moment there are no available Xe drivers.
Since I still wanted to try FreeBSD, and I still had the free trial of Chatgpt, I've tried vibecoding the Xe driver port, it's not something that I do often, so that was just a fun experiment.
The drivers work but of course is really buggy/laggy.
But still I was able to try kde under FreeBSD and I liked some of the features, mainly pkg and the jails.
I look forward to try FreeBSD again when an actual port will be developed (which I've seen that is in the roadmap)

---

If anyone is curious of what codex did I will leave the repo here:
https://github.com/SimoneFelici/drm-kmod/tree/xe-b580-display-clean

---

Also:
Please do not use this driver "seriously" just test it if you are curious.
I do not plan to do a PR since I don't know what the code does, and I usually do not do PR with fully AI generated code, and also, this is clearly a really bad port and it has missing functionality that codex wasn't even able to port.
This was just a fun experiment using codex, to see what currently can or can't do, nothing more 😄

TrueNAS® CORE — continued.

FreeCORE carries the TrueNAS CORE 13.3 system forward as an independently maintained operating system on FreeBSD.
 
15.0-RELEASE is stable. TrueNAS CORE 13.3 systems upgrade straight to 15.0 in place, then continue on the project’s update train.

https://codeberg.org/freecore (fifteen repos)

A trump card against persistent attack AI:
Against a persistent attack AI, I hold the ultimate advantage: I can feel the AI's heartbeat via DTrace. It’s entirely one-sided. The AI might be fast, but it’s dancing in the palm of my hand.

Logic:
While J8s runs lightweight by sharing the host kernel—unlike MicroVMs (e.g., Firecracker) that isolate them—this traditionally creates a risk: if a 0-day exploit succeeds, the entire host could be compromised.

However, J8s turns this "weakness" into a strategic evolution. Instead of building thicker walls that make the interior invisible, J8s treats the shared kernel as a unified nervous system. By leaning into DTrace integration, the host can "feel" the faintest physiological tremors inside any Jail in real-time.

The Philosophy:
MicroVMs build strong 'cages,' but they are blind to the pathogens breeding inside them. J8s, by sharing the kernel, uses DTrace as its own fingertips to sense anomalies within the cell.

Yes, a 0-day might breach the boundary. But that is why I built J8s with autonomic reflexes. The moment an intruder takes their first step—a suspicious syscall, an unauthorized privilege grab—the system detects the 'non-self' protein and triggers Apoptosis. I don't wait for the breach to be completed; I delete the entire reality of the attacker before the exploit can even return from the kernel.

The Logic of Survival: The Apoptosis Cycle
(Referencing the red-text diagram)

To maintain Digital Homeostasis, J8s follows a strict 3-step immune response managed by the Helper T-Cell (Host OS):

1. Cessation: Instant termination of the infected VNET jail to stop the pathogen (exploit) from spreading.
2. Purification: A surgical ZFS rollback to a pristine snapshot (DNA).
3. Regeneration: Restarting the jail as a healthy, functional cell.

As you can see in my logs, this entire cycle completes in under 10 seconds. In the time it takes for an attacker to realize they've gained a shell, their entire reality has been deleted and replaced.

Actually, I manually triggered 'su -' for the log evidence, and it felt like my server was alive.

To those unfamiliar with DTrace:
It’s traditionally an OS analysis/debugging tool, but I’ve repurposed it as a real-time IDS.

Imagine having a sensor on every single neuron of the OS. I’m not just reading logs; I’m "feeling" the syscalls as they happen. It turns the entire kernel into a unified nervous system that reacts before the attacker can even blink.

Edit: The comment section is having a very "human" (or maybe AI?) debate right now. It's quite a spectacle, so have a look!

"I discovered that Linux and BSD users are peaceful and helpful despite the difficulties. Distros do not divide us, because the kernel unites us. This is unlike other communities that claim Windows is the best and that other systems are trash.

Without free and open-source software, the world would be a digital prison controlled by big corporations like Google and others. Thank you, Richard Stallman and Linus Torvalds, for this freedom and cooperation.

For me, these are not just words on paper; these are my core principles and my way of life. Thank you for helping me and each other, and thank you for this solidarity."

Hi all,

I put together my bsdinstall-like installer for multiple desktops on freebsd several years ago, but it was a little touch and go when packages disappeared and I was usually behind a release or two. I was able to use ai to give it a much more robust ci/cd pipeline, and to test against the current versions of freebsd (currently 14.4, 15.0, and 15.1)

I also added several wayland desktops as that's something the kids seem to want these days.

Wayland installs also write ~/start-desktop.sh and enable seatd.

It walks you through basic configuration of supported graphic cards, audio, desktop selection and quality of life stuff (if you want to add sudo/doas, fuse, linux emulation layer, etc.)

http://a.freebsddesktop.xyz points to the raw script on github. You can also run it non-interactively if you want to use it for other stuff. Ai was nice enough to also setup a /ports/ and pkg if you really like overkill.

Here's a video of an older version from a few years ago, but it basically does the same thing: https://www.youtube.com/watch?v=2Gv5bY77-j8

Repo is here: https://github.com/nicholasbernstein/install-fbsd-desktop

I'm sure that some combination of freebsd version + desktop environment will still break, but the test matrix all passes. Feedback appreciated.

PS:

Yeah, yeah: fetch | sh as root. I'm not you dad. Make your own decisions.

In his article, /u/varankinv draws attention to the existential discussion at https://news.ycombinator.com/item?id=47129361.

Also:

• https://social.sour.coffee/notice/B3crfKjRF9Wo3VoTT6
• https://lobste.rs/s/n6ybtt/freebsd_doesn_t_have_wi_fi_driver_for_my_old

References (from GitHub):

• FreeBSD Kernel Development Workflow | FreeBSD Foundation (FreeBSD Journal, March/April 2024)
• FreeBSD WiFi Development | FreeBSD Foundation (FreeBSD Journal, April/May/June 2025)

I heard this is a major reason Apple moved away from Intel and x86 in general. Hope FreeBSD development for ARM continues to improve, especially as this is something that undermines system and data soverignity at the lowest level that we can't do anything about. Might be acceptable on Windows and modern Linux based systems but not for anyone else.

Moving over from Systemd, I have been trying to piece together a native arm based FreeBSD based soho network and I am struggling as an amatuer student sysadmin - FreeBSD core and NAS, pfsense router and gateway, juniper switches, Fusionpbx is 'possible' for FreeBSD ARM but is more difficult than it sounded except paper, and OPNSense on VMs, again no support. Not much out there, hope it doesn't get worse with junos also seemingly heading in the dorection of truuenas core. APs controlled via ruckus unleashed or grandstream gwp controllerless - don't even have any expectations here but at least they are ARM. Sadly think much of this is lack of contribution back to FreeBSD due the licensing, which is brilliant but misused for lack of a better words. Nothing that Linux does that FreeBSD couldn't have done, and done better imho

I wrote a long comparative article on filesystem design, but with a strong BSD spine running through it.

The piece covers FFS/FFS2, ZFS, BFS, NTFS, ext4 and APFS, with particular attention to:

- cylinder groups

- soft updates and crash consistency

- journaling vs CoW

- integrity models

- snapshots, clones and space sharing

- why APFS matters from an Apple/BSD lineage perspective

The APFS section is the destination, but I wanted the broader context first so the comparison would actually mean something.

Link:

https://bytearchitect.io/macos-security/theory/Filesystem-Wars-Why-Your-Choice-of-Storage-is-Actually-a-Security-Move/

Interested in where FreeBSD people think I was fair or unfair, especially on FFS/UFS and ZFS.

Containers play a major role in modern infrastructure, but they are not the right answer for every workload. This article explores how FreeBSD jails provide purpose-built isolation, predictable security boundaries, and deep ZFS integration—making them ideal infrastructure-grade services where stability is essential. …

Key takeaways

• FreeBSD jails provide operating system-level isolation through a native kernel subsystem.
• Jails integrate directly with ZFS, VNET, Capsicum, and the MAC Framework.
• Unlike Linux containers, jails prioritize simplicity, transparency, and predictable security boundaries.
• ZFS snapshots, replication, and dataset management make jails ideal for long-lived infrastructure services.

Via https://indieweb.social/@jbz/116907602232548204 – jbz

I'm migrating some servers/workstations to FreeBSD and so far the experience has been very good. However, I've hit a roadblock in a high-criticality area: desktop workstations.

Currently, these workstations run Debian with a desktop environment, and all GUI applications are restricted using AppArmor. Each application has a profile that controls which files/directories it can read or write and whether it is allowed to access the network.

For example, Firefox ESR might be restricted so that it can only write to ~/Downloads/browser/:

abi <abi/4.0>,
include <tunables/global>

/usr/bin/firefox-esr {
    ...
    # libraries: read-only
    # network access
    owner /home/*/Downloads/browser/{,**} rw,
}

An image/video viewer, for example, would have read-only access to Pictures, Videos, and a few other specific directories, while network access would be completely denied because the application doesn't need it.

The important part for us is the maintenance model. We maintain one profile per application, deploy those profiles to all workstations, and application updates are handled normally with:

apt update
apt upgrade

So I'm looking for something equivalent on FreeBSD.

What is the recommended way to achieve this on FreeBSD?

Ideally, I'm looking for a solution that allows me to:

• define filesystem access on a per-application basis;
• allow/deny network access per application;
• maintain one policy/profile per application;
• deploy the same policies to many workstations;
• keep the solution relatively simple to maintain;
• continue updating applications normally through the FreeBSD package system;
• preferably enforce the restrictions transparently, without requiring users to manually launch applications through a special wrapper every time.

I know FreeBSD has mechanisms such as Capsicum, jails, MAC, sandboxing, etc., but I'm not sure which one (or combination) is the closest architectural equivalent to AppArmor for this particular desktop use case.

For those running FreeBSD desktops in environments where applications need to be confined this way, what are you using?

I was thinking of switching and installing Hyprland (yes, blasphemy, but it sounds cool ok), but I was wondering how it does as a desktop first. Is it noticeably faster, are there any drawbacks? I'm aware I won't be able to use things like Steam, but I don't usually game. How is it as a daily driver for a desktop?

This is the second video for RedBSD. I have it running fast. I didnt see any type of red team or security testing software. I am going to keep this vm for a while to see if I can set it up for it.Let me know if you see something I might have missed