Sorry for this pain point :( we will hopefully have VNET default in 11.0.

Slightly risky way: you can run freebsd-update fetch and then install twice, and you will notice it updates /usr/src.. it will instruct you to reboot after the first install, but instead do another install and you will notice that /usr/src has been updated. Rebuild your custom kernel and reboot. You risk changed ABIs during this, in practice it may be fine but depends how much you care about the box and whether you are comfortable cleaning up from a chroot if things go really bad.

Better: use svnlite in base or real SVN to update /usr/src to the releng/10.3 branch. Build your kernel, reboot, do freebsd update to get the base updates and make sure your kernel is intact.

Best: use svnlite to update /usr/src. Do buildkernel, reboot. Do buildworld and follow https://www.freebsd.org/doc/handbook/makeworld.html. The more you run FreeBSD, the more you will want to follow -STABLE or -CURRENT and do your own release engineering.

Future best: Use any method to derive custom kernel, use packaged base to update base. Or again hopefully common use wont need a custom kernel.

I'm normally a Linux user but found FreeNAS too restrictive and then spent 2 months worth of spare time fiddling with this thing.

The learning curve seems vertical at times but I'm finding FreeBSD quite refreshing. Ports and pkg-ng are great (although Australia really, really needs a local mirror).

The files I need to boot from live on a USB thumbdrive and I've got IPMI to the box so I'm not too worried. I think buildworld would be pretty slow on this box (Atom C2758). I'll give it a shot.

I don't really need vnet but having IPs per jail and some kind of network seperation made more sense to my brain.

Yeah VNET is a pretty advanced feature at this point, hopefully once it's in 11 it will be more approachable to new users without any drawbacks.

jails seem like an advanced feature to me - so much manual configuration. Docker has ruined me by hiding the complexity.

Hah, weird. For me, Docker seems to create complexity. Daemon, API, registry…

I made a tiny tool that spins up a jail with nullfs/unionfs mounts and RCTL resource limits from a single JSON/UCL file: https://github.com/myfreeweb/sandblast

I've found ezjails[0] to be pretty nice for managing jails: https://www.freebsd.org/doc/handbook/jails-ezjail.html

It also has nice ZFS support. Here's a short, well written, howto showing an ezjails+PF+ZFS install/config process: https://forums.freebsd.org/threads/30063/

0 - https://www.freebsd.org/cgi/ports.cgi?query=ezjail-3&stype=n...

check out the 'iocage' pkg if you want to hit the ground running

You repeat the same process. svn update your src and the rebuild your world and kernel. That is the price for custom kernel configs, no more kernel binary distribution (unless you setup your own build server, which you really don't want to do).

What's the reason I can't use `pkg` to update my userland and then just rebuild the kernel instead of rebuilding everything from source?

currently the base userland is not controlled by the pkg system. You can use freebsd-update to do a binary upgrade, which will also sync your kernel sources if you have stuff in /usr/src, so you can simply rebuild kernel after running the update.

Should be noted in 11-CURRENT there is currently ongoing work to move userland and the generic kernel into pkg, so look forward to that as well.

I reverted to a generic kernel (it doesn't look like I ever had /boot/GENERIC - did I read out of date doco?), then ran freebsd-update as normal. Seems to be fine. I'll rebuild my custom kernel later.