FreeBSD 15 for Gentoo admins
bub-docs · cheatsheet · unix administration
FreeBSD 15 for Gentoo admins
A translation layer for people who already run Gentoo in anger: the same jobs, the FreeBSD 15.x way. Mapping tables first, commands second, traps last.
01Mental model
Gentoo is a meta-distribution assembled from upstream projects by Portage. FreeBSD is one operating system (kernel plus userland, one source tree, one release team) with third-party software layered on top through ports.
| Dimension | FreeBSD 15 | Gentoo |
|---|---|---|
| Unit of the OS | base (kernel + userland from src) and ports (everything in /usr/local) | Every component is a package, including the toolchain and libc |
| Default delivery | Binary: freebsd-update or pkgbase for base, pkg for ports | Source: emerge; official binhost is optional |
| Customisation knob | Port OPTIONS, src.conf WITHOUT_* knobs, kernel config | USE flags, CFLAGS, profiles, package.* files |
| Release cadence | Fixed: minor releases on a schedule, major every two years | Rolling; profiles mark ABI eras (23.0) |
| Init | BSD rc.d with rc.conf | OpenRC or systemd |
| Config location | Base in /etc, ports in /usr/local/etc | Everything in /etc |
| Filesystem of choice | ZFS is first-class in base and the installer | Any; ZFS is an out-of-tree package |
| Containers | Jails (kernel native) | Namespaces + cgroups (Docker, Podman, LXC) |
| Documentation | Handbook, man pages are authoritative and current | Wiki and Handbook, upstream man pages |
02Release and support model
The single biggest operational difference: on FreeBSD you track a supported point release and plan a jump; on Gentoo you never stop moving.
| Item | Value | Note |
|---|---|---|
| 15.0-RELEASE | 2 Dec 2025 | EoL 30 Sep 2026; move to 15.1 now |
| 15.1-RELEASE | 16 Jun 2026 | Supported until 31 Mar 2027 |
| stable/15 branch | until 31 Dec 2029 | Branch support cut from five to four years starting with 15 |
| Next major | 16.0 | Planned for Dec 2027; file sets and freebsd-update are planned to go away in favour of pkgbase |
| Branches | releng/15.1, stable/15, main | Roughly: stable ~ ~amd64 mindset, main ~ live ebuilds |
| pkg repos | quarterly / latest | quarterly is the stable default; latest tracks ports HEAD |
| Gentoo equivalent | stable vs ~arch keywords | Profile switch (for example 17.1 to 23.0) is the nearest thing to a major upgrade |
where am I
freebsd-version -kru # installed kernel, running kernel, userland uname -a pkg -vv | grep -A3 url # which pkg repo branch is active
03Package management: pkg vs emerge
pkg is a binary manager with a SQLite database in /var/db/pkg. Think of it as Portage with --getbinpkgonly forced on, plus apt-like ergonomics.
| Task | FreeBSD | Gentoo |
|---|---|---|
| sync and update | ||
| Refresh catalogue | pkg update -f | emaint sync -a |
| Upgrade everything | pkg upgrade | emerge -avuDN @world |
| Show pending upgrades | pkg version -vIL= | emerge -puDN @world |
| Read news | /usr/ports/UPDATING, pkg updating | eselect news read |
| install and remove | ||
| Install | pkg install nginx | emerge -av www-servers/nginx |
| Remove | pkg delete nginx | emerge --deselect nginx then depclean |
| Remove orphans | pkg autoremove | emerge -a --depclean |
| World set | pkg prime-list (non-automatic packages) | /var/lib/portage/world |
| Mark as explicitly wanted | pkg set -A 0 pkgname | emerge --noreplace pkg |
| Pin a version | pkg lock pkgname | package.mask with > atom |
| query | ||
| Search | pkg search -x '^nginx' | eix nginx / emerge -s |
| Info | pkg info -f nginx | equery meta, emerge -pv |
| Files of a package | pkg info -l nginx | equery files / qlist |
| Owner of a file | pkg which /usr/local/sbin/nginx | equery belongs / qfile |
| Reverse deps | pkg info -r pkgname | equery depends |
| Built options | pkg query '%Ok %Ov' nginx | equery uses |
| Integrity check | pkg check -sa (checksums), pkg check -d | qcheck, emerge @preserved-rebuild |
| Clean cache | pkg clean -a | eclean-dist, eclean-pkg |
No slots. FreeBSD ships parallel versions as separate package names (
python311, python312, postgresql17-server), not as slots of one atom. Default versions are set ports-wide via DEFAULT_VERSIONS in /etc/make.conf, which is the closest thing to eselect.04Building from source: ports, OPTIONS and poudriere
If you want the Gentoo experience on FreeBSD, the answer is poudriere, not building ports in place. poudriere builds in clean jails and publishes a pkg repo, which is exactly a private Gentoo binhost.
| Concept | FreeBSD | Gentoo |
|---|---|---|
| Tree | /usr/ports (git clone of ports.git) | /var/db/repos/gentoo |
| Recipe | Port Makefile + pkg-plist | .ebuild + eclasses |
| Feature toggles | OPTIONS (make config) | USE flags |
| Global toggles | OPTIONS_SET / OPTIONS_UNSET in /etc/make.conf | USE= in make.conf |
| Per-package toggles | category_port_SET+= / _UNSET+= | /etc/portage/package.use/* |
| Saved option state | /var/db/ports/<cat>_<port>/options | Recorded in vdb per package |
| Compiler flags | CFLAGS / CPUTYPE in make.conf | CFLAGS, -march in make.conf |
| Clean-room builder | poudriere (jails, also ZFS clones) | Catalyst, or emerge --buildpkg in a chroot |
| Consume own builds | Custom repo in /usr/local/etc/pkg/repos/ | PORTAGE_BINHOST, binrepos.conf |
| Overlays | poudriere -O overlays, or a forked tree | eselect repository, overlays |
| Make tool | BSD make (bmake); GNU make is gmake | GNU make |
freebsd: poudriere binhost
pkg install poudriere git poudriere jail -c -j 151amd64 -v 15.1-RELEASE poudriere ports -c -p default -m git+https poudriere options -j 151amd64 -f /usr/local/etc/poudriere.d/pkglist poudriere bulk -j 151amd64 -p default \ -f /usr/local/etc/poudriere.d/pkglist
gentoo: equivalent intent
# /etc/portage/make.conf FEATURES="buildpkg" PKGDIR="/var/cache/binpkgs" emerge -avuDN @world # clients: binrepos.conf + getuto emerge -avuDN --getbinpkg @world
freebsd: per-port options in /etc/make.conf
OPTIONS_UNSET+= DOCS EXAMPLES X11 www_nginx_SET+= HTTPV2 HTTPV3 DEFAULT_VERSIONS+= python=3.12 pgsql=17 ssl=base
Do not mix freely. Building one port in
/usr/ports on a box that otherwise uses the official quarterly repo works, until the next pkg upgrade replaces it with the stock build. Either pkg lock it, or move the whole box to your own poudriere repo.05Updating the base system
Gentoo has one update path. FreeBSD 15 has three for the base system, and you pick one per host. pkgbase is the future; in 15.x it is an optional technology preview chosen at install time.
fig 1 · base update paths in FreeBSD 15 vs the single Gentoo path; ports packages always go through pkg
| Path | Patch level | Major / minor jump | Fit |
|---|---|---|---|
| freebsd-update | freebsd-update fetch install | freebsd-update -r 15.1-RELEASE upgrade | default GENERIC kernel, binary shops |
| pkgbase | pkg upgrade -r FreeBSD-base | Repoint repo ABI, then pkg upgrade (follow relnotes) | 15.x preview one tool for base and ports, BE friendly |
| source | git pull releng/15.1, rebuild | Switch branch, rebuild | Gentoo-like custom kernel, src.conf knobs |
binary minor upgrade
bectl create pre-15.1 && bectl list freebsd-update -r 15.1-RELEASE upgrade freebsd-update install # kernel shutdown -r now freebsd-update install # userland pkg upgrade -f # only on a major jump freebsd-update install # remove old libs
source build (the Gentoo way)
git -C /usr/src pull cd /usr/src make -j$(sysctl -n hw.ncpu) buildworld buildkernel make installkernel && shutdown -r now etcupdate -p make installworld etcupdate -B make delete-old delete-old-libs
Pick one per host. From 15.1, a system installed from pkgbase packages refuses
installworld and installkernel, to keep the package database consistent. Build packages with make packages or poudriere instead.06Merging configuration
| Task | FreeBSD | Gentoo |
|---|---|---|
| Three-way merge of /etc | etcupdate (replaced mergemaster) | dispatch-conf / etc-update |
| Show conflicts | etcupdate status, etcupdate resolve | find /etc -name '._cfg*' |
| Protected paths | Everything in /etc; ports configs ship as *.sample | CONFIG_PROTECT |
| Ports config upgrade | pkg keeps your file if it differs from the old sample | ._cfg0000_ files |
| Edit rc.conf safely | sysrc name=value, sysrc -x name | /etc/conf.d/* per service |
| Drop-in configs | /etc/rc.conf.d/<service>, /usr/local/etc/pkg/repos/ | /etc/portage/*/ directories |
07Boot, kernel and modules
| Task | FreeBSD | Gentoo |
|---|---|---|
| Boot loader | loader(8) (Lua), config in /boot/loader.conf | GRUB, systemd-boot, EFI stub |
| Kernel source | Part of /usr/src/sys, same tree as userland | sys-kernel/gentoo-sources, eselect kernel |
| Distribution kernel | GENERIC (shipped, updated by freebsd-update) | gentoo-kernel-bin / gentoo-kernel |
| Custom kernel config | sys/amd64/conf/MYKERN with include GENERIC, nodevice | make menuconfig, .config |
| Build and install | make buildkernel installkernel KERNCONF=MYKERN | make && make modules_install install |
| Initramfs | None needed (loader preloads modules) | dracut, installkernel |
| List / load modules | kldstat, kldload, kldunload | lsmod, modprobe, rmmod |
| Load at boot (early) | if_wg_load="YES" in loader.conf | Built in, or initramfs |
| Load at boot (late) | sysrc kld_list+="vmm" | /etc/modules-load.d/*.conf |
| Kernel params | Tunables in loader.conf, runtime sysctl / /etc/sysctl.conf | Kernel cmdline, /etc/sysctl.d/ |
| Fallback kernel | /boot/kernel.old, select at loader menu, or a boot environment | Older entry in GRUB |
| Scheduler choice | 15.1 kern.sched.name tunable at boot | Kernel config (EEVDF default upstream) |
08Services and init
rc.d is closest to OpenRC in spirit (shell scripts with dependency keywords via rcorder), but enablement lives in rc.conf variables instead of runlevel symlinks.
| Task | FreeBSD rc.d | OpenRC | systemd |
|---|---|---|---|
| Enable | service nginx enable | rc-update add nginx default | systemctl enable nginx |
| Start / stop | service nginx start | rc-service nginx start | systemctl start nginx |
| Run once without enabling | service nginx onestart | rc-service nginx start | systemctl start |
| Status | service nginx status | rc-status | systemctl status |
| List enabled | service -e | rc-update show | systemctl list-unit-files |
| Script locations | /etc/rc.d, /usr/local/etc/rc.d | /etc/init.d | /usr/lib/systemd/system |
| Per-service settings | nginx_flags, nginx_profiles in rc.conf | /etc/conf.d/nginx | drop-in .conf |
| Supervision | daemon(8) with -r restart | supervise-daemon | Restart= |
| Logging | syslogd + newsyslog | syslog-ng / sysklogd + logrotate | journald |
| Scheduled jobs | cron + periodic(8) daily, weekly, monthly | cronie / fcron | timers |
09Networking and firewall
| Task | FreeBSD | Gentoo |
|---|---|---|
| NIC names | Driver plus index: em0, igc0, vtnet0 | Predictable names: enp3s0 |
| Persistent config | ifconfig_em0="DHCP", defaultrouter= in rc.conf | netifrc /etc/conf.d/net, NetworkManager, networkd |
| IPv6 | ifconfig_em0_ipv6="inet6 accept_rtadv" | config_eth0="... ", or dhcpcd |
| Apply | service netif restart && service routing restart | rc-service net.eth0 restart |
| Bridges, VLANs, lagg | cloned_interfaces="bridge0 vlan10 lagg0" | bridge_, vlans_ in conf.d/net |
| Routes | route, netstat -rn | ip route |
| Sockets | sockstat -46l | ss -tulpn |
| Firewall | pf (/etc/pf.conf, pfctl), ipfw also in base | nftables / iptables |
| WireGuard | if_wg in kernel, wg from wireguard-tools | In kernel, wireguard-tools |
| Wi-Fi | wlan0 cloned from driver, wpa_supplicant; LinuxKPI drivers (iwlwifi, rtw89), native iwx | Kernel drivers, wpa_supplicant / iwd |
freebsd: pf baseline
sysrc pf_enable=YES pflog_enable=YES
cat > /etc/pf.conf <<'EOF'
ext_if = "em0"
set skip on lo
block in log all
pass out quick keep state
pass in on $ext_if proto tcp to port { 22 443 }
EOF
pfctl -nf /etc/pf.conf && service pf startfreebsd: pf operations
pfctl -sr # rules pfctl -ss # states pfctl -si # counters pfctl -t bad -T add 203.0.113.9 tcpdump -n -e -ttt -i pflog0
10Storage, GEOM and ZFS
GEOM is the block layer (think device-mapper, but composable as classes). ZFS is in base, shares the release cycle, and boot environments are a native workflow rather than a project.
| Task | FreeBSD | Gentoo |
|---|---|---|
| Disk names | ada0 (SATA), nda0 (NVMe), da0 (SCSI / USB) | sda, nvme0n1 |
| List disks | geom disk list, camcontrol devlist, nvmecontrol devlist | lsblk |
| Partitioning | gpart show, gpart add -t freebsd-zfs | fdisk, parted, sgdisk |
| Labels | gpart add -l then /dev/gpt/label | /dev/disk/by-partlabel/ |
| Software RAID | gmirror, graid, or ZFS | mdadm |
| Encryption | geli, or ZFS native encryption | LUKS (cryptsetup) |
| ZFS module | In base, version tied to the release (OpenZFS 2.4 in 15) | sys-fs/zfs + zfs-kmod, rebuild per kernel |
| Boot environments | bectl create / activate / list | ZFSBootMenu or manual datasets |
| I/O live view | gstat -p, zpool iostat -v 1 | iostat -x 1, iotop |
| SMART | smartmontools from ports | sys-apps/smartmontools |
| fstab quirks | No UUID mounts by default; use GPT labels | UUID / PARTUUID |
freebsd: boot environment routine
bectl create pre-change # snapshot + clone of the root dataset # ... upgrade, break things ... bectl activate pre-change # roll back on next boot bectl activate -t pre-change # temporary: one boot only bectl destroy -o old-be # remove with its origin snapshot
11Users and privilege
| Task | FreeBSD | Gentoo |
|---|---|---|
| Add user | adduser (interactive), pw useradd -n bob -m -G wheel -s /bin/sh | useradd -m -G wheel bob |
| Modify groups | pw groupmod wheel -m bob | gpasswd -a bob wheel |
| Change shell / info | chsh, chpass | chsh, usermod |
| Password database | vipw rebuilds /etc/master.passwd + pwd.db | /etc/shadow |
| su access | Must be in wheel | Optional via pam_wheel |
| Privilege escalation | mdo + mac_do 15 in base; doas, sudo from ports | sudo, doas |
| Login classes | /etc/login.conf + cap_mkdb (limits, env, umask) | limits.conf, PAM |
| Root shell | /bin/sh (default since 14.0) | bash |
12Isolation and virtualisation
| Need | FreeBSD | Gentoo |
|---|---|---|
| OS containers | Jails: /etc/jail.conf, jail -c, jls, jexec | LXC / Incus |
| Jail managers | BastilleBSD, pot, AppJail | Docker, Podman |
| Per-jail networking | VNET (vnet + epair) | Network namespaces, veth |
| Resource limits | rctl (enable kern.racct.enable=1 in loader.conf) | cgroups v2 |
| OCI containers | Podman with ocijail (jail based); OCI images of FreeBSD published | Docker, Podman native |
| Hypervisor | bhyve + vmm.ko; vm-bhyve for management | KVM + QEMU, libvirt |
| Linux binaries | Linuxulator: sysrc linux_enable=YES, linux_base-rl9 | Native |
| Capability sandboxing | Capsicum (in-process) | seccomp, landlock |
freebsd: minimal thin jail on ZFS
zfs create -p zroot/jails/web
fetch https://download.freebsd.org/releases/amd64/15.1-RELEASE/base.txz
tar -xf base.txz -C /zroot/jails/web
cat >> /etc/jail.conf <<'EOF'
web {
path = "/zroot/jails/web";
host.hostname = "web";
ip4.addr = "em0|192.0.2.20";
exec.start = "/bin/sh /etc/rc";
exec.stop = "/bin/sh /etc/rc.shutdown";
mount.devfs;
}
EOF
sysrc jail_enable=YES jail_list+="web"
service jail start web && jexec web pkg bootstrap13Observability toolbox
| Question | FreeBSD | Gentoo / Linux |
|---|---|---|
| Hardware inventory | pciconf -lv, usbconfig, devinfo -v | lspci, lsusb |
| Boot messages | /var/run/dmesg.boot, dmesg | dmesg, journal |
| CPU / memory | sysctl hw.model hw.ncpu hw.physmem | /proc/cpuinfo, free |
| Processes | top -SH, top -m io, procstat -a | top, htop, /proc/PID |
| Open files of a PID | procstat -f PID, fstat -p PID | lsof -p |
| Syscall trace | truss -f, ktrace + kdump | strace -f |
| Dynamic tracing | dtrace in base | bpftrace |
| Interface traffic | systat -ifstat 1, netstat -w 1 -I em0 | ip -s link, nload |
| VM stats | vmstat 1, systat -vmstat | vmstat 1 |
| /proc | Not mounted by default; mount procfs or linprocfs only if a tool needs it | Always present |
| File watching | 15 native inotify(2), plus kqueue | inotify |
14Security operations
| Task | FreeBSD | Gentoo |
|---|---|---|
| Vulnerable packages | pkg audit -F (VuXML) | glsa-check -l affected |
| Base advisories | FreeBSD-SA / FreeBSD-EN, fixed by freebsd-update | GLSA, fixed by world update |
| Daily reports | periodic security mails (setuid changes, failed logins, pkg audit) | Roll your own (cron + glsa-check) |
| Hardening at install | bsdinstall hardening menu, security.bsd.* sysctls | Hardened profile, kernel config |
| Kernel lockdown | kern_securelevel_enable=YES, kern_securelevel=2 | Lockdown LSM |
| Immutable files | chflags schg (enforced at securelevel 1+) | chattr +i |
| MAC frameworks | mac_bsdextended, mac_portacl, mac_do | SELinux, AppArmor |
| Audit trail | auditd (OpenBSM), praudit | auditd |
| Crypto baseline | OpenSSL 3.5, OpenSSH 10 in base | Whatever is current in the tree |
15What is new in the 15 series
| Change | Release | Why a Gentoo admin cares |
|---|---|---|
| Packaged base (pkgbase) | 15.0 | Base becomes FreeBSD-* packages managed by pkg; optional in 15.x, planned default for 16 |
| pkgbasify | 15.0 | Foundation-sponsored tool to convert an existing file-set install to pkgbase |
| Native inotify | 15.0 | Linux-oriented tooling ports with fewer patches |
| mac_do + mdo | 15.0 | Run commands as another user without a setuid binary; policy via MAC rules |
| Unprivileged, reproducible release builds | 15.0 | Release images and VM images built without root |
| 32-bit kernels retired | 15.0 | No i386, armv6 or 32-bit powerpc kernels; 32-bit binaries still run on 64-bit; armv7 remains |
| Shorter branch support | 15.0 | Four years per major, new major every two years |
| Selectable scheduler | 15.1 | kern.sched.name loader tunable |
| LinuxKPI Wi-Fi refresh | 15.1 | Wireless drivers synced with Linux 7.0 sources |
| installworld blocked on pkgbase hosts | 15.1 | Source builds on pkgbase systems must go through packages |
16Traps for Gentoo hands
| Habit | What happens on FreeBSD | Do instead |
|---|---|---|
Editing /etc/nginx/ | Does not exist; ports live under /usr/local | /usr/local/etc/nginx/ |
#!/bin/bash | No bash in base | pkg install bash, use #!/usr/bin/env bash, or write POSIX sh |
sed -i 's/a/b/' f | BSD sed treats the next argument as the backup suffix | sed -i '' 's/a/b/' f |
GNU flags (grep -P, ls --color, date -d) | BSD userland, different flags | Read the man page, or install coreutils (prefixed g) |
make in a Linux project | bmake, not GNU make | gmake |
| Building ports on a pkg-managed host | Next pkg upgrade overwrites your build | poudriere repo, or pkg lock |
Expecting /proc | Absent by default | procstat, sysctl, or mount procfs |
Skipping the second freebsd-update install | Kernel and userland out of sync | Kernel, reboot, userland, (rebuild ports), cleanup |
| Mixing quarterly and latest | ABI drift between packages | One branch per host in /usr/local/etc/pkg/repos/FreeBSD.conf |
Hand-editing /etc/passwd | Ignored; the db is rebuilt from master.passwd | vipw, pw |
| Upgrading without a safety net | Gentoo trained you to fix forward | bectl create first; rollback is one reboot |
Rule of thumb. Treat the base system like a firmware image you do not touch, and treat
/usr/local as your Gentoo. The split is the whole philosophy.
0 коментара