Great stuff! I love the "going further" links to give some good suggestions on stuff to check out next, too. Promising start! Cheers to Solène for kicking this off.
I used to be a BSD nut. Everything everywhere BSD. Hack it so easy. All in one repository. Made life easy.
Now a days I’m in a different type of easy. Linux does everything. Submit to systemd because it makes it easier.
I miss my rebellious teenage BSD years but now I just get shit done with Linux.
Maybe one day I’ll have a mid life crisis and switch back. I’ve had thoughts of it before. Maybe when the kids are older and I have the time.
I think you may find that "just get shit done" is even more true for BSD today than it is for Linux, haha :) Depends, but... I am practically shocked at how problem-free FreeBSD and OpenBSD have been for me (other than when I use obscure unsupported hardware! haha) ... even with updates and totally customized configs, etc. Keep it in the back of your mind to dive into again, for sure!
Recently I set up OpenBSD on an old ThinkPad R61i.
Yesterday or the day before I used that machine to do web dev and some system administration stuff, and got more done faster than I usually do on my main machine.
That partially may be because it was just slower, and so I didn't have cycles to waste on HN or whatever else, but it was at least partially because it "just worked" for the stuff that I threw at it.
Unveil and pledge are great at restricting and effectively sandboxing processes a la a simpler version of Linux's SECCOMP. If you're using namespaces for process isolation or sandboxing, it can do the trick.
They're not a general replacement for Linux's namespaces, though. The only alternative on OpenBSD would be running the alternative environment in a VM, or running Linux in a VM and then using namespaces there.
FreeBSD comes closer with jails, but still doesn't match the ease of which you can use rootless namespaces to e.g. dump a tar file of a rootfs into a directory and "chroot" into it, all without root.
(the OpenBSD world will never implement this sort of thing by design, and it has merits, as user namespaces has created several privilege escalation vulnerabilities over the years, which is one reason some distros like RHEL/CentOS disable it on their kernels)
