Cells for NetBSD - NetBSD-native Isolation as an Operational System

Challenge

The goal of Cells for NetBSD was to provide a pragmatic middle ground for NetBSD between simple chroot setups and full virtualization.

This was never meant to replicate Linux container ecosystems. The focus was a NetBSD-native model with clear operational boundaries:

• kernel-enforced isolation and policy decisions
• reproducible host operations without extra runtime layers
• understandable, declarative control for day-to-day administration

Approach

I implemented a layered architecture with clear responsibilities:

• secmodel_cell as the kernel foundation for identity, isolation, and policy enforcement
• cellctl as the runtime-near interface for lifecycle actions and snapshot metrics
• cellmgr as the unified control plane for desired state, runtime state, reconciliation (apply), and backup/restore
• cellui as an interactive TUI for operational workflows

The operating model is declarative at its core: manifests describe the full target state, and cellmgr apply converges the system to that state in a repeatable way.

To validate practical viability, I also built and operated end-to-end stacks under realistic conditions, including a MantisBT stack (PostgreSQL, php_fpm, nginx) and a Luanti server scenario.

Result

Cells for NetBSD has evolved from a pure isolation prototype into a cohesive operating model:

• consistent CLI contracts for humans and automation (TSV/schema validation)
• reproducible convergence via cellmgr apply
• integrated backup/restore workflows for volumes and overlay state
• transparent operation via CLI and TUI without hidden control layers

In parallel, project documentation is continuously expanded, including man pages and practical end-to-end recipes.

Project page: https://netbsd-cells.petermann-digital.de/

Snapshot

• Domain: System software / NetBSD / isolation
• Time frame: 2025-present
• Technologies:
  • NetBSD kernel (secmodel_cell, kauth)
  • cellctl, cellmgr, cellui
  • shell, C, curses/TUI
  • Prometheus-compatible metrics exports
• Status: experimental, actively developed

Cells for NetBSD stands for a deliberately lean, NetBSD-native isolation approach: clear states, clear tools, clear operations.