事前准备#

参考 https://www.truenas.com/docs/scale/scaletutorials/apps/sandboxes/

创建jailmaker用的数据集#

在你随机池创建jailmaker的文件夹，名字随意，我这里直接命名为jailmaker

Untitled

安装jailmaker#

进入目录

1
cd /mnt/[池名字]/[刚刚创建的目录名]

我这里例子是池：tank 目录名: jailmaker

1
cd /mnt/tank/jailmaker
2
curl --location --remote-name https://raw.githubusercontent.com/Jip-Hop/jailmaker/main/jlmkr.py
3
chmod +x jlmkr.py

PS：此时已经可以运行通过指定文件位置来运行，但是如果想在任何地方直接输入jlmkr来运行的话，可以输入下面的命令

1
echo alias jlmkr=\"sudo '/mnt/[池名字]/[刚刚创建的目录名]/jlmkr.py'\" >> ~/.zshrc
2
source ~/.zshrc

添加开机启动#

照抄

替换中间命令的部分

1
/mnt/[池名字]/[刚刚创建的目录名]/jlmkr.py startup

Untitled

安装系统以及Docker环境#

命令行输入

1
jlmkr

提示你是否创建，输入 Y 按下回车

1
root@truenas[~]# jlmkr
2
Create a new jail? [Y/n] y
3

4
USE THIS SCRIPT AT YOUR OWN RISK!
5
IT COMES WITHOUT WARRANTY AND IS NOT SUPPORTED BY IXSYSTEMS.

提示你用模板的方式。

1
A text editor will open so you can provide the config template.
2

3
  1. Please copy your config
4
  2. Paste it into the text editor
5
  3. Save and close the text editor
6

7
Press Enter to open the text editor.

输入 Enter ，会进入nano的输入界面，此时你需要复制下面的代码，粘贴到里面后，按下 ctrl+x，再按 Y 再按 回车

1
startup=0
2
#直通intel显卡把值改成1
3
gpu_passthrough_intel=0
4
#直通nvidia显卡把值改成1
5
gpu_passthrough_nvidia=0
6
# Turning off seccomp filtering improves performance at the expense of security
7
seccomp=1
8

9
# Use macvlan networking to provide an isolated network namespace,
10
# so docker can manage firewall rules
11
# Alternatively use --network-macvlan=eno1 instead of --network-bridge
12
# Ensure to change eno1/br1 to the interface name you want to use
13
# You may want to add additional options here, e.g. bind mounts
14
# 注意这里的br0需要提前改成自己网络对应的网桥名字
15
systemd_nspawn_user_args=--network-bridge=br0
16
    --resolv-conf=bind-host
17
    --system-call-filter='add_key keyctl bpf'
18

19
# Script to run on the HOST before starting the jail
20
# Load kernel module and config kernel settings required for docker
21
pre_start_hook=#!/usr/bin/bash
22
    set -euo pipefail
23
    echo 'PRE_START_HOOK'
24
    echo 1 > /proc/sys/net/ipv4/ip_forward
25
    modprobe br_netfilter
26
    echo 1 > /proc/sys/net/bridge/bridge-nf-call-iptables
27
    echo 1 > /proc/sys/net/bridge/bridge-nf-call-ip6tables
28

29
# Only used while creating the jail
30
distro=debian
31
release=bookworm
32

33
# Install docker inside the jail:
34
# https://docs.docker.com/engine/install/debian/#install-using-the-repository
35
# Will also install the NVIDIA Container Toolkit if gpu_passthrough_nvidia=1 during initial setup
36
# https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/latest/install-guide.html
37
initial_setup=#!/usr/bin/bash
38
    set -euo pipefail
39

40
    apt-get update && apt-get -y install ca-certificates curl
41
    install -m 0755 -d /etc/apt/keyrings
42
    curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
43
    chmod a+r /etc/apt/keyrings/docker.asc
44

45
    echo \
46
    "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian \
47
    $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
48
    tee /etc/apt/sources.list.d/docker.list > /dev/null
49

50
    apt-get update
51
    apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
52

53
    # The /usr/bin/nvidia-smi will be present when gpu_passthrough_nvidia=1
54
    if [ -f /usr/bin/nvidia-smi ]; then
55
        curl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey -o /etc/apt/keyrings/nvidia.asc
56
        chmod a+r /etc/apt/keyrings/nvidia.asc
57
        curl -s -L https://nvidia.github.io/libnvidia-container/stable/deb/nvidia-container-toolkit.list | \
58
        sed 's#deb https://#deb [signed-by=/etc/apt/keyrings/nvidia.asc] https://#g' | \
59
        tee /etc/apt/sources.list.d/nvidia-container-toolkit.list
60

61
        apt-get update
62
        apt-get install -y nvidia-container-toolkit
63

64
        nvidia-ctk runtime configure --runtime=docker
65
        systemctl restart docker
66
    fi
67

68
    docker info
69

70
# You generally will not need to change the options below
71
systemd_run_default_args=--property=KillMode=mixed
72
    --property=Type=notify
73
    --property=RestartForceExitStatus=133
74
    --property=SuccessExitStatus=133
75
    --property=Delegate=yes
76
    --property=TasksMax=infinity
77
    --collect
78
    --setenv=SYSTEMD_NSPAWN_LOCK=0
79

80
systemd_nspawn_default_args=--keep-unit
81
    --quiet
82
    --boot
83
    --bind-ro=/sys/module
84
    --inaccessible=/sys/module/apparmor

此时提示你输入jail的名字，输入你想要的，我这里实例为 docker

（这里的名字和后面修改hosts有关）

1
Enter jail name: docker
2
Do you want to start this jail now (when create is done)? [Y/n] Y

并且在之后提示中按 Y ，回车

此时就会进入安装环节，中间应该要等待，其次需要科学，因为模板需要从lxc库拉取镜像，docker源也需要。

等待跑码结束就完成安装了

输入下面命令进入docker的系统

1
jlmkr shell [应用名]

然后就能正常像使用所有docker一样使用，安装jellyfin，portainer之类的

另外ip是独立于与TrueNAS的，输入下面命令可以查看ip

1
#在Truenas中
2
jlmkr list
3
#在docker系统中
4
ip a

挂载文件#

在TrueNAS输入jlmkr edit [应用名] 来编辑配置文件

在下面一块加入 systemd_nspawn_user_args 参数中

Untitled

1
--bind='/truenas/path/to/:/jail/path/to'

/truenas/path/to/ 是TrueNAS中路径

/jail/path/to 是你想要挂在到sandbox里面的路径