How to Manage FreeBSD Jails with iocage

FreeBSD jails can be managed directly through jail.conf, but iocage wraps that same underlying mechanism in a much friendlier command-line tool for creating, cloning, and managing jails day to day.

Step 1: install iocage

pkg install py311-iocage

Step 2: activate a ZFS pool for iocage to use

iocage activate zroot

iocage relies on ZFS specifically to give each jail its own dataset, enabling fast cloning and snapshotting — activating a pool tells iocage which one to use for that storage.

Step 3: fetch a release to create jails from

iocage fetch -r 14.0-RELEASE

This downloads the base system for the specified release once, used afterward as the template every jail created from it is built from.

Step 4: create a new jail

iocage create -n mywebserver -r 14.0-RELEASE ip4_addr="em0|192.168.1.50/24"

This creates a jail named mywebserver, based on the fetched 14.0-RELEASE, with a static IP bound to the em0 interface.

Step 5: start and enter the jail

iocage start mywebserver
iocage console mywebserver

iocage console drops you into an interactive shell inside the running jail — equivalent to jexec, but resolved automatically by jail name rather than needing to look up a jail ID first.

Step 6: install software inside the jail

# from inside the console session:
pkg install nginx
sysrc nginx_enable=YES
service nginx start

Once inside, a jail behaves like an ordinary FreeBSD system for installing and configuring software — the isolation iocage provides is at the jail boundary, not inside it.

Step 7: snapshot a jail before a risky change

iocage snapshot mywebserver

Because iocage jails live on ZFS datasets, snapshotting is instant and cheap — a natural safety net before an upgrade or a configuration change you’re not fully confident about.

Step 8: clone a jail as a template for creating more

iocage clone mywebserver -n mywebserver2

Cloning an existing, already-configured jail is often faster than fetching and configuring a new one from scratch when you need several similar jails.

Step 9: stop and destroy a jail when it’s no longer needed

iocage stop mywebserver
iocage destroy mywebserver

Why iocage is worth using over raw jail.conf for most setups

Hand-writing jail.conf entries works fine for one or two jails, but iocage’s ZFS-backed dataset-per-jail model gives every jail fast, native snapshotting and cloning essentially for free — capabilities that are possible but considerably more manual to replicate by hand. For anyone managing more than a small handful of jails, or who wants safe, instant rollback before risky changes, iocage’s overhead is well worth it over managing raw configuration files directly.