But docker is just a frontend for linux containers :) You're not comparing the right things here: Linux containers with a popular frontend and all the trimmings, to barebones FreeBSD jails.
Have you ever looked at what Docker puts in your iptables? I challenge you to understand what's happening with your networking after that.
If you want containers, lxc command line and a bit of configuration for a bridge interface is all you really need.
And that is the attitude embraced by jails (to be clear: rather more cleanly and attractively than the expression of the same ideas in linux), and precisely why it lost.
No one wants "containers". They want docker. They want to be handed something that looks no more threatening than a mid-80's build script and have it magically be it's own little world with all its own software and versions and stuff, but still talk to the rest of the world on the same networks from the same piece of hardware (yes, via some weird voodoo to glue all that together).
It's like arguing that no one needs word processing because nroff or LaTeX is all you need. It's not wrong. It's just a failure in the market.
Why are you wasting time with ipfw?
Some forwarding rules.
> I challenge you to understand what's happening with your networking after that.
They're incredibly simple forwarding rules, to make sure that only the containers that you specify can connect to the Internet, and all the others in a particular group can only connect to each other.
> If you want containers, lxc command line and a bit of configuration for a bridge interface is all you really need.
Yes, assuming you never need to maintain it, or run more than one project per server.
Dockerfiles make it super simple. There is similar stuff for jails but you need a jails frontend that use it.
A few years ago i wanted to build the Jailfile equivalent, call it Warden, and have Warden manage the jails.
But honestly i doubt it would get traction outside a small community.