Please report to EBC Helpdesk FIRST to fetch your badge.
== Registration for FreeBSD Summit ONLY ==
This is the FreeBSD Devsummit. You can find more information here: https://wiki.freebsd.org/DevSummit/202609
Pick up your badge here! Please bring your 6 byte order code in whatever format.
This is the FreeBSD Devsummit (cont). You can find more information here: https://wiki.freebsd.org/DevSummit/202609
An Introduction to the Filesystems and Networking
in the FreeBSD Open-Source Operating System
Dr. Marshall Kirk McKusick
Author and Consultant
Who Should Take this Course
This course provides a broad overview of how the FreeBSD kernel implements its basic services. It will be most useful to those who need to learn how these services are provided. Individuals involved in technical and sales support can learn the capabilities and limitations of the system; applications developers can learn how to effectively and efficiently interface to the system; systems programmers without direct experience with the FreeBSD kernel can learn how to maintain, tune, and interface to such systems. This course is directed to users who have had at least a year of experience using a UNIX-like system. They should have an understanding of fundamental algorithms (searching, sorting, and hashing) and data structures (lists, queues, and arrays).
Description
This course will provide a firm background in the filesystems and networking capabilities supported by the FreeBSD kernel. The course describes the VFS filesystem interface that supports multiple filesystem types. The course covers the implementation and capabilities of the UFS filesystem and the techniques for maintaining filesystem consistency. The filesystem section ends with a description of the ZFS filesystem capabilities, implementation, and integration into FreeBSD. The course also covers the socket-based network architecture, layering, and implementation. The socket communications primitives and internal layering will be discussed, with emphasis on the interfaces between the layers; the TCP/IP implementation will be used as an example. A discussion of routing issues and the netmap interface will be included. The presentations will emphasize code organization, data structure navigation, and algorithms. It will not cover the machine specific parts of the system such as the implementation of device drivers.
Morning - Filesystems Overview
- Filesystem organization
- Block I/O system (buffer cache)
- Support for multiple filesystems
- UFS Filesystem implementation
- ZFS Filesystem implementation
Afternoon - Networking Implementation
- System layers and interfaces
- Internet Protocols
- Mbufs and control blocks
- Routing issues
- TCP algorithms
Course Text
Prior to taking the course, students are recommended to obtain a copy of the course text: Marshall Kirk McKusick, George Neville-Neil, and Robert N. M. Watson, ``The Design and Implementation of the FreeBSD Operating System'', Second Edition, Pearson Education, Boston, MA September 2014, ISBN-13: 978-0-321-96897-5, ISBN-10: 0-321-96897-2.
Learn what the EU Cyber Resilience Act is and what it means for you. Then, deep dive into SBOMs and discover how to choose the right tools for dependency management.
The European Union Cyber Resilience Act (CRA), along with similar international legislation, will come into force during 2026 and 2027. These regulations introduce new legal obligations requiring software to be secure by design and by default, while also imposing strict deadlines for reporting exploited vulnerabilities.
This session will explain the obligations introduced by the new legislation and explore how they affect open source developers and companies that market “products with digital elements” (PDEs).
While some view these changes as risky or burdensome - particularly for open source developers - this session takes a different perspective, focusing on the opportunities this new legal framework creates.
This session combines an overview of the CRA with practical guidance on the tools and processes that can help developers and organisations adapt. More importantly, it frames the legislation as an opportunity: a chance for the free software community to strengthen supply chain transparency, improve dependency management, and bring established software engineering practices more fully into everyday development.
This half-day workshop provides an introduction to the Game of Trees version control system.
Game of Trees (Got) is a version control system which prioritizes ease of use and simplicity over flexibility.
Game of Trees is being developed on OpenBSD. A portable version runs on FreeBSD, NetBSD, DragonflyBSD, MacOS, and Linux.
Game of Trees uses Git repositories to store versioned data, and can be used as a drop-in replacement or as a companion to Git.
It will always remain possible to work with both Game of Trees and Git on the same repository.
Game of Trees is an original version control system which relies on prior art, takes what makes Git's design great, leaves out some parts that make Git hard to use, and invents new parts for an end result which serves the needs of its developers and many other people who use version control.
Simple and consistent interface design makes Game of Trees approachable, while still being powerful enough for making contributions to projects which use Git.
If you find Git intimidating and confusing, or if you only ever use a handful of the 322 commands Git provides and become frustrated when something goes wrong, you might enjoy using Game of Trees.
Even if you have never used Git, or any version controls system at all, learning Game of Trees will prepare you well for learning tools such as Git, Mercurial, and Jujutsu, later on.
This workshop's main focus will be the Game of Trees command line client and repository browser for text terminals.
Game of Trees can also be used to host Git repositories on servers, and we will briefly touch on this, too.
Pick up your badge here! Please bring your 6 byte order code in whatever format.
bhyvecon is the only conference dedicated to BSD Hypervisors including FreeBSD/Illumos bhyve, FreeBSD/NetBSD Xen, OpenBSD vmm, and NetBSD Xen/nvmm/HAXM with a sprinkling of Jails and Zones.
An Introduction to the Kernel Services and I/O System
of the FreeBSD Open-Source Operating System
Dr. Marshall Kirk McKusick
Author and Consultant
Who Should Take this Course
This course provides a broad overview of how the FreeBSD kernel implements its basic services. It will be most useful to those who need to learn how these services are provided. Individuals involved in technical and sales support can learn the capabilities and limitations of the system; applications developers can learn how to effectively and efficiently interface to the system; systems programmers without direct experience with the FreeBSD kernel can learn how to maintain, tune, and interface to such systems. This course is directed to users who have had at least a year of experience using a UNIX-like system. They should have an understanding of fundamental algorithms (searching, sorting, and hashing) and data structures (lists, queues, and arrays).
Description
This course will provide a firm background in the kernel services and I/O structure of the FreeBSD kernel. The course will cover basic kernel services, locking, process structure, scheduling, signal handling, jails, capsicum sandboxing, and virtual and physical memory management. The kernel I/O structure will be described showing how I/O is multiplexed, disks are managed, special devices are configured, and system virtualization is done. The presentations will emphasize code organization, data structure navigation, and algorithms. It will not cover the machine specific parts of the system such as the implementation of device drivers.
Morning - Kernel Overview
- Process structure
- Locking
- Communications
- Process Groups and Sessions
- Jails
- Scheduling
- Signals and timers
- Virtual memory management
Afternoon - Kernel I/O structure
- I/O data structures
- Disk Management
- Multiplexing I/O
- Autoconfiguration strategy
- Configuration of a device driver
Course Text
Prior to taking the course, students are recommended to obtain a copy of the course text: Marshall Kirk McKusick, George Neville-Neil, and Robert N. M. Watson, ``The Design and Implementation of the FreeBSD Operating System'', Second Edition, Pearson Education, Boston, MA September 2014, ISBN-13: 978-0-321-96897-5, ISBN-10: 0-321-96897-2.
The NetBSD Foundation is looking forward to organizing a NetBSD devsummit at EuroBSDCon 2026.
The primary focus of this are NetBSD and pkgsrc developers, but others may join too.
The details of the summit are yet to be planned in detail, but overall the idea can be summarized as sharing knowledge about things in NetBSD and pkgsrc that are not (yet) known to many other developers and in general connecting NetBSD and pkgsrc developers. Some potential topics for the devsummit are PGP key signing, NetBSD 11, and knowledge sharing about personal development
environments.
The OpenBSD Packet Filter (PF) is at the core of the network management toolset available to professionals working with the BSD family of operating systems.
Understanding the networking toolset is essential to building and maintaining a functional envirionment. The present session will both teach principles and provide opportunity for hands-on operation of the extensive network tools available on OpenBSD and sister operating systems in a lab environment. Participants will be performing practical excercises in their choice of OpenBSD and FreeBSD environments. Basic to intermediate understanding of TCP/IP networking and basic Unix command line skills are expected and required for this session.
Topics covered include
The basics of and network design and taking it a bit further
Building rulesets
Keeping your configurations readable and maintainable
Seeing what your traffic is really about with your friend tcpdump(8)
Filtering, diversion, redirection, Network Address Translation
Handling services that require proxying (ftp-proxy and others)
Address tables and daemons that interact with your setup through them
The whys and hows of network segmentation, DMZs and other separation techniques
Tackling noisy attacks and other pattern recognition and learning tricks
Annoying spammers with spamd
Basics of and not-so basic traffic shaping
Monitoring your traffic
Resilience, High Availability with CARP and pfsync
Troubleshooting: Discovering and correcting errors and faults
Your network and its interactions with the Internet at large
Common mistakes in internetworking and peering
Keeping the old IPv4 world in touch with the new of IPv6
The tutorial is lab centered and fast paced. Time allowing and to the extent necessary, we will cover recent developments in the networking tools and variations between the implementations in the OpenBSD and FreeBSD operating systems.
Participants should bring a laptop for the hands on labs part and for note taking. The format of the session will be compact lectures interspersed with hands-on lab excercises based directly on the theory covered in the lecture parts.
This session is an evolutionary successor to previous sessions. Slides for the most recent version of the PF tutorial session are up at https://nxdomain.no/~peter/pf_fullday.pdf, to be updated with the present version when the session opens.
Sylve is the new FreeBSD Foundation sponsored VM and jail manager for FreeBSD.
In this tutorial I will cover
- Prerequisites
- Installation and set up
- Creating and managing jails
- Creating and using jail templates
- Networking concepts for jails - virtual switches, firewall & NAT
- Deploying applications in jails using Ansible
- Snapshot and backup concepts
For hands on exercises attendants should bring a laptop capable of running FreeBSD inside a local hypervisor of choice.
Target audience: operators of FreeBSD based infrastructure
Level: beginner
We presented the chaos education system at BSDCan 2025/2026 with great interest from the audience. Based on the feedback from BSDCan, EuroBSDcon and AsiaBSD conferences, we included all the suggestions from the audience and improved the system significantly. We now want to give attendees the opportunity to test the system by themselves by running through a couple of scenarios.
Sysadmin, users, and learners are encouraged to try their skills in a virtual environment each managing a server which will experience problems that they then have to solve. After solving the problem, a highscore list will show how fast the problem was solved in comparison to the other participants. After each round, we will discuss the problem, what people did to diagnose it and what kind of solutions they employed to solve it. This increases the learning for everyone and allows skill sharing among the group. After multiple such rounds, the winner will be announced.
Participants will require a laptop with an internet connection to work on the assignments. We will provide login details at the beginning of the tutorial and allow time to familiarize with the environment before we start.
Shell scripts have a bad reputation when it comes to usability and eye candy. Modern users find a blinking cursor on a a black screen leaves a lot to be desired when having to interact with a shell script. In this tutorial, we will create shell scripts that look like a GUI application: with buttons to press, input fields, select boxes and animated progress bars. These so called TUI (text user interfaces) programs still use shell script functionality as the backend, but are lightweight enough to not introduce too much overhead. Users will appreciate the ease of use of your shell scripts and you can rely on them to give you the data and visualizations you to need. At the same time, the TUI application is not difficult to learn and implement into existing scripts.
There have been a number of such libraries in the past. The most prominent one is ncurses, which is a newer implementation of System V Release 4.0 (SVr4) curses, which itself is an enhancement over the discontinued 4.4 BSD curses. The modern BSD version is bsddialog, created by Alfonso Sabato Siciliano. This is what we are going to use in this tutorial.
The FreeBSD Ports Collection is one of the largest third-party software repositories in the open-source world. According to Repology, it ranks in the top four in terms of the number of packages, maintainers, and up-to-date packages. Alright, that's great, but how does it work? What is this mystical ports framework? Why is it so powerful?
The workshop has 3 parts: user usage, ports maintenance, and framework development. The ports framework is a dense codebase and you'll need a map to navigate it. This workshop is the map. The workshop's goal is to raise your confidence in using ports, help you understand the framework's current limitations, and enable you to modify the framework and contribute those changes back.
Pick up your badge here! Please bring your 6 byte order code in whatever format.
With warm welcome...
The European Union Cyber Resilience Act (CRA) and its various international analogs are entering fully into force during 2026 and 2027, with new legal requirements that some have found to be perilous or challenging to software developers and possibly for open source developers in particular.
This session takes the approach that the challenging legal requirements provide a wealth of opportunities for software engineers in the free software space to, finally, be allowed to perform proper software engineering. We offer practical advice on what to do and how to navigate the choppy seas of legalisms, and to position yourself with best practices and proper tooling integrated in your development workflow.
This talk is based on the article with the same name, https://nxdomain.no/~peter/what_hascan_eu_cra_donedo_for_you.html which was also the base for my presentation at BSDCan 2026. This talk will come with any relevant updates that happen by the time of the EuroBSDCon 2026 conference.
When your DNS resolvers and internal authoritative name servers go down, everything goes down. We needed a setup where failover is automatic and consisted of several layers of redundancy - so we turned to BGP.
This talk walks through our current production architecture, where Unbound serves as the resolver and ExaBGP orchestrates route withdrawals for fast failover. I'll share what we've learned setting this up and outline our plans to extend it further: possibly replacing ExaBGP with OpenBGPD for a more flexible BGP integration, and introducing multi-vendor DNS software to eliminate single-point-of-failure risk at the application layer in the case of a software bug.
Along the way, I'll dig into the specific challenges we faced in parts of our network that are IPv6-only - in particular, getting DNS64 to work in a complex internal DNS landscape.
It was the night of 10 March 2021, and I had only just fallen asleep. A notification woke me. Then another, then another. Different servers, different workloads, but all with one thing in common: the same data centre.
I got up to check. A temporary connectivity issue? Then a tweet: a fire had gutted SBG2. It was threatening SBG1, SBG3 and SBG4 as well.
My wife looked at me and asked if I wanted a coffee. I nodded. The mission was simple to state and much harder to carry out: bring the critical services back up before 8, and restore everything else as quickly as possible.
It was going to be a long day.
In this talk, I will tell the story of what happened that night: the recovery, the architectural choices that saved us and the ones that turned out to be fragile at the very worst moment, because people usually only talk about the ones that worked.
Above all, I will explain why, ever since, I have looked at BSD systems not as mere operating systems, but as practical tools for building infrastructure that is simpler, easier to understand and more resilient. That night, I learned that first hand.
This talk shows, with a live demo, how stock unmodified FreeBSD 14.x runs on Windows' WSL2 platform, showcasing how FreeBSD's existing architecture lets it run unchanged in the new virtualization environment. FreeBSD on WSL2 could potentially provide a new, seamless channel for developers and students on Windows to access native FreeBSD, achieved through minimal userland bridges, with zero kernel modifications.
Architectural pieces covered:
- High-performance interactive terminal leveraging FreeBSD's native hvsock (AF_HYPERV) implementation
- Clean kernel/userland separation
- Serial console for early boot visibility, solving the early-boot silent console issue via serial I/O redirection
- Ongoing work on implementing the Guest Networking Service (GNS) userland bridge and 9P Host File integration
FreeBSD powers critical infrastructure around the globe, but deploying it successfully in the enterprise requires far more than a technically excellent operating system.
This session examines the operational realities of running FreeBSD in environments with strict security, compliance, stability, and support expectations. Drawing on real-world experience, we will discuss how organizations evaluate risk, manage software lifecycles, plan upgrades years in advance, and maintain confidence in the systems that underpin their critical infrastructure and services.
Topics include vulnerability management, release engineering, deployment at scale, package management, and regulatory compliance. Attendees will leave with a deeper understanding of both the strengths and the challenges of operating FreeBSD at enterprise scale.
Modern computers are collections of heterogenous components, including GPUs, TPUs, NPUs, FPGAs and other devices that carry out computing tasks but which are not the central CPU. We are proposing novel methods of program compilation, transformation and scheduling that take advantage of the entire system so that computation takes place in the most appropriate place at the most propitious time. Using LLVM IR, optimizers, and a performance aware scheduler, we can maximize utilization while reducing execution times for arbitrary workloads, freeing developers from treating modern computers as if they were fixed function platforms. This research has applications in high performance computing, embedded systems and security due to the centrality of run time program transformation in our system. We present our results thus far from work on FreeBSD CURRENT, including updates to both the performance monitoring system (hwpmc) and a new scheduler based on performance counters.
This talk will present the current state of the input device "stack" on OpenBSD, and discuss some ideas for upcoming changes in order to get the console, X.Org and Wayland applications the best possible support.
There are challenges with the different event encoding models, hot-plugging devices and handling their suspend and resume life cycles.
NetBSD has had a good test suite for its native syscalls for a long time. Linux also has a test suite for its native syscalls. NetBSD is capable of running Linux binaries by providing syscall emulation. Wouldn't it be nice if these were tested too?
This talk discusses different methods that could be used to test Linux emulation including porting the Linux Test Project and subverting NetBSD's own test suite. This work is based on a Google Summer of Code project by Henrique Brito.
Working as an incident response engineer i often encounter the "worst case scenario" where no part of the breached infrastructure can be trusted. The incident response has to be swift and yet, the recovery process takes a lot of time. New problems arise every hour, from failed storage to infiltrated network firewall. No matter if you are dealing with APTs from China or a ransomware grup from Russia the same toolkit is usable - FreeBSD.
If you interested how you can manage a larg scale incident using FreeBSD than this is a talk for you.
A challenge when setting up VPNs is the proper modification of the routing table. This is needed, so that all traffic goes through the VPN interface and is encrypted, except the encrypted traffic generated by the VPN interface. Even so, this approach has its pitfalls, which can cause leaking unencrypted traffic[[1]].
Network namespaces offer a way to categorically solve this problem. Network namespaces partition the network interfaces present in a host. A process running in a given network namespace only sees the interfaces present within that network namespace. If only the VPN interface is present, traffic will have to go through this interface, making it impossible to send traffic through another interface by accident.
On OpenBSD network namespaces are called routing domains. Combine routing domains with Wireguard, which is routing domains aware out of the box, offer safer VPNs, while also simplifying configuration. A similar effect can be achieved for other VPNs by using virtual machines.
In this talk we go over the problems when just modifying the routing table, how routing domains work and can be used.
You don't like concurrency and you liked it better when only one kernel could be running at a time on one CPU. You got comfortable using mutexes and condition variables to make things go one at a time. But your packets keep getting stuck, and the hair raises on the back of your head as you begin to suspect you'll have to think about memory ordering in a device driver that got ported sloppily from Linux. What now?
This talk will discuss the bus_dma(9) model of memory ordering, obscure issues in paravirtualization, incoherent mappings on different architectures, and tools that a hacker can use to formally verify their memory ordering -- along with limitations of those tools.
STUNMESH-go is an open-source tool that enables direct peer-to-peer WireGuard connections between devices behind NAT or CGNAT. It multiplexes STUN and WireGuard traffic on the same UDP port by interacting directly with the kernel WireGuard module, avoiding the overhead of userspace proxies. Originally Linux-only, we ported STUNMESH-go to FreeBSD and macOS. This talk covers the technical challenges we encountered: adapting from Linux raw sockets to BPF-based per-interface packet capture, porting the health monitoring and automatic reconnection system, and ensuring the plugin-based peer discovery mechanism works across platforms. We validated our work on OPNsense firewalls, VyOS routers, and mixed BSD/macOS/Linux full-mesh topologies.
IT infrastructure is becoming ever more complex. To serve a simple modern web application we need orchestrators, containers, server side renderers and a bunch of 3. party tools and services. And this is in addition to the slew of dependencies it takes to get the application itself to run. An alternative approach might be to use a good old-fashioned web server to serve web pages, javascript and resources to a browser.
In this talk I will present my, a BSD noob, experiences deploying a SPA web application directly on an OpenBSD vm using only the built-in web server (httpd) and other built-in tools without any docker, NodeJS or any other fancy dependencies. I will talk about meeting unknown commands, figuring out how to configure httpd and TLS using somewhat outdated descriptions and noticing interesting surprises in the logs.
Besides being a fun little exercise, this is also about control of our systems. As we build systems with ever more layers of indirection we also increase risk for various supply chain vulnerabilities as well as not really understanding our systems. This talk also aims to show that it is possible to serve modern applications based on an understandable stack.
Base system packages, or pkgbase for short is the FreeBSD initiative to move the operating system binaries from large binary archives to individual packages using the FreeBSD package manager, pkg(8).
In my talk, I will demonstrate how to utilize base system packages to perform FreeBSD OS updates.
By building pkgbase packages locally, it is easy to upgrade large numbers of hosts.
I will begin by explaining what pkgbase is and how to migrate existing Infrastructure, using the PKGBasify Script to convert existing hosts to be pkgbase-ready, and then using pkgbase to perform future upgrades.
I will move on to a build server to generate Base packages and publish them to the network via NGINX, as well as using that server to distribute Base packages.
I will walk through how to configure a client to perform major, minor and patch level upgrades utilizing the new pkgbase tech preview.
I use this pkgbase on a day-to-day basis in production environments that are not directly connected to the Internet to replace the previous workflow of manually updating from source, giving the overall update and deployment process a significant speed-up.
rcd(8) is a new service manager that has been carefully designed for FreeBSD, bringing modern features such as service monitoring, parallelization, socket activation and more while being fully backward compatible with rcNG.
It leverages all native features of FreeBSD: process descriptors, jails, resource management, cpuset, kqueue, and process reaper.
This presentation will dive into the history behind rcd(8), its design, and the new set of features it brings to FreeBSD.
This talk shares our experience in designing and deploying a FreeBSD-based platform that provides a runtime environment for EDA (electronic design automation) software. This project is supported by MEXT (the Ministry of Education, Culture, Sports, Science and Technology of Japan) and aims to reinforce Japan’s semiconductor industry. The speaker has been responsible for the computer system component of the project.
The core platform was designed using FreeBSD, whereas most industry-standard semiconductor design and manufacturing tools are Linux-based. From an integrated circuit designer’s perspective, a common challenge is building and maintaining a workstation capable of running such software. One of the primary design goals was to create a system that is easy to use for students unfamiliar with Linux, while also minimizing the burden of system administration, which can otherwise become a barrier to education.
FreeBSD provides a number of mature technologies for virtualization and compartmentalization, and the system has been built on top of them. This talk covers how these technologies are used, as well as additional components that were developed to meet specific requirements. It also discusses the deployment strategy, which aims to make the platform available throughout Japan.
The ARM platform is revolutionary in its flexibility and overall quality of NOT having to be compatible with a 1980 PC. Modern ARM64 systems stand out for offering high-performance, high core counts, virtualization extensions, and comparatively low power draw.
Learn about FreeBSD on ARM64 platforms ranging from the Raspberry Pi to the Ampere Altra, with special attention to OpenZFS and bhyve.
Admit it. You also have a drawer of small ARM systems. Some might still boot!
Linux dominates modern cloud infrastructure, leaving little room for BSD workloads and forcing teams into dedicated BSD hosts or separate infrastructure. This talk proposes an alternative: integrating BSD workloads directly into existing Linux container environments using urunc, a container runtime designed for unikernels and single-application kernels. From Rumprun unikernels to BSD workloads running on FreeBSD and NetBSD, urunc brings BSD-based applications natively into container workflows, including OCI registries, orchestration platforms, and CI/CD pipelines. The talk covers the architecture, storage, volume and network support, trade-offs, and closes with a live demo of building and running BSD workloads with Docker and deploying them on Kubernetes.
Cloud-init is the de facto standard for initial instance configuration across many cloud environments. However, its implementation is heavily Linux-centric and does not map cleanly to native FreeBSD VM images. This talk will describe the project's origins, design decisions, and key implementation details. It will show how the client leverages FreeBSD native technologies—rc(8), flua(1), and libucl—to provide a lightweight, fully integrated cloud-init-compatible agent. The resulting solution is robust enough to support OpenStack and numerous public cloud providers, while also fitting smaller ISP-provided VM appliances that expose basic virtualization features. Attendees will leave with a clear understanding of the tradeoffs made, integration points, and real-world deployment considerations.
In 1972, Ken Thompson added a script to Version 2 AT&T UNIX: "locate and run off a particular section of this manual". This tool, "man", closed the loop for computer system documentation, allowing it to be distributed, developed, and accessed within the same system---and all with one set of simple tools.
How does this tooling look, 54 years later?
In this talk, I'll survey both the manpage and other popular documentation ecosystems. I'll then look at what modern tools are available for manpages, and how we can lower the barrier of entry for new documentation into the system.
Social Event has Doors ......XXXX....
Please bring your badge!!
Pick up your badge here! Please bring your 6 byte order code in whatever format.
Who's going to save the world from AI's insatiable energy use? You are.
Take a whirlwind tour of AI's energy and resource use with Anne Currie, author of Building Green Software, the Green Software Maturity Matrix from the Green Software Foundation, and the forthcoming update, the Green AI Maturity Matrix. Where are we now, how did we get here and how can we (and are we) digging ourselves out?
In June 2026, the FreeBSD entries in dozens of upstream .cirrus.yml files became dead code. For roughly five years, Cirrus CI had been doing; almost invisibly; what FreeBSD's own internal CI was never designed to do: making it trivial for upstream open-source projects (LLVM, Rust, Python, PHP, Node.js, libuv, curl, and others) to test their software against FreeBSD on every pull request, with no infrastructure for them to operate. That capability is now gone. Nothing in the current market replaces it.
This talk argues that FreeBSD's adoption ceiling is set by whether upstreams can test on FreeBSD; not just by whether we can test FreeBSD ourselves. It works through four threads: what Cirrus quietly solved between 2019 and 2026, and why most of the community didn't notice; the current landscape of partial substitutes (vmactions/freebsd-vm, self-hosted Jenkins, the GitHub Actions BSD gap, the in-tree pre-commit tooling) and why none of them fits the shape of the upstream-facing problem; why no individual developer can plug this gap, and why this is a company-scale problem rather than a hobby one; and what FreeBSD is already paying for the absence; in enterprise procurement conversations, contributor attrition, and quiet drop-outs in upstream release notes.
The talk closes with a five-point specification for what a viable successor would have to look like, and asks three groups in the room for specific action: the FreeBSD community, the Foundation and enterprise users, and the upstream maintainers themselves.
Forty minutes; five for questions. Technical, opinionated, assumes the audience knows what make buildworld does.
Embargoes create myth about security fixing. In OpenBSD we have an
errata process to provide source and binary patches for stable
releases. This requires a mixture of secrecy and fast acting.
What are the requirements for a small team to build fixes? Where
is the line between security issues and regular bug fixes? What
effect does the number of increased AI reports have on this process?
There is a CVE, will there be a fix? How do companies with products
based on OpenBSD interact?
This talk will answer these questions and we may also collect
interesting views from the audience.
AMD SEV encrypts a VM's memory with a per-VM key hidden from the hypervisor, but encryption is only useful if the guest owner can prove what was actually launched. This talk presents a complete AMD SEV host stack for FreeBSD bhyve, running today on AMD EPYC hardware, with pre-attestation.
I will follow one encrypted Ubuntu 25.04 guest through the stack, and a new asp(4) driver for AMD Secure Processor, vmm/SVM changes for SEV ASIDs, bhyve userspace and a FreeBSD port of sevctl for measurement verification and launch secret injection, and a clean BhyveSevX64 OVMF platform.
The result boots attested SEV guests with SMP, tested with 8 vCPUs, and working virtio-net 1.0 on Ubuntu 25.04.
The bhyve hypervisor recently gained the ability to add or remove emulated PCI devices to a running virtual machine [1].
This talk will showcase the key design and implementation details that went into adding support for ACPI-based hotplugging to the bhyve(8) hypervisor.
We'll start with a deep dive into bhyve(8)'s device emulation model and the related parts of the virtual machine initialization process. Using this overview, we will analyze the limitations of bhyve's current device emulation model and explore the key architectural changes that were required to enable runtime PCI device hotplugging.
We will then explore the newly implemented PCI hotplugging mechanism, starting with a bird's-eye view of the interactions between the hypervisor and the guest and continuing with each component of the mechanism, diving into key implementation details along the way.
The talk will also include a demo of bhyve(8)'s new PCI hotplugging capabilities and the overall workflow for adding or removing PCI devices from a virtual machine. We will end with an overview of upcoming work for CPU and memory hotplugging.
[1] https://lists.freebsd.org/archives/freebsd-virtualization/2026-January/003412.html
GEFS is a crash-safe, snapshotting, corruption-detecting, simple, and reasonably fast file system. It's built on a write-optimized data structure known as a Bε tree.
Originally developed for Plan 9, and shipped on 9Front in 2024, it is now in production use. It runs 9Front build infrastructure, some web servers, and is in wide use among 9Front users. Few of them claim to have been on mind altering substances when they made this decision.
A version of it is in progress for OpenBSD. It's ready to destroy your data.
In this talk, the speaker will describe the user facing features of GEFS. They'll talk about how the data structures work internally. That will be followed by a discussion of how this connects to the VFS layer in OpenBSD, and finally, will wrap up with a summary of what's still broken.
The speaker has been using this file system on their Plan 9 laptop for over a year at this point, and has only lost other people's data.
p.s. It's pronounced with 'G' as in 'GIF'
In this talk, we describe our current work in progress on supporting hibernate on FreeBSD. First, we outline the different high-level steps that are necessary. Then, we delve into how we actually implement them, including ACPI interfacing and programming, how we take a snapshot of kernel memory, save the image to disk and restore it on boot. Finally, we report on this development's status.
Today's security landscape is terrifyingly different from what we enjoyed a year ago. How does FreeBSD help keep us secure in this new and uncertain time?
What's the pipeline from patch -> patched with FreeBSD? How fast can we go? What's stopping us from going faster?
This talk covers:
- how the security posture evolved on a commercial FreeBSD project
- the plumbing within the FreeBSD releng, security, & clusteradm teams to support this
- a behind-the-scenes look at what the project plans to do in the near future
There are several hard problems still getting solved in pkg_add:
- a framework for objects common to several packages. Users, groups, configuration files and whatnot. The classic model of upgrade = remove + re-add is no longer sustainable
- some large pieces of software like texlive require a bit of handholding to make subpackages more sustainable
- specialty languages like ocaml require specific fragments for various file types that are arch-dependent.
After a decade and a half of academic and industrial research, products using CHERI to provide hardware enforced, deterministic memory safety are making their way to market. CheriBSD, a research fork of FreeBSD, has been the primary vehicle for operating system research on supporting CHERI's memory safety and compartmentalization potential. We are now bringing the most complete and stable work from CheriBSD to FreeBSD with the goal shipping FreeBSD 16 with spatial and temporal memory safety. This talk will motivate this upstreaming, explain our plan, and cover progress to date. We hope to update the FreeBSD community on our progress and encourage other BSDs to learn from our adoption of CHERI.
This talk will cover the custom installation of a FreeBSD environment on a physical (or virtual) server to provide a system with full disk encryption that can be remotely unlocked via SSH (optionally combined with Tor onion services) — the main disk partition may provide encrypted ZFS pools or datasets (where we install the operating system and/or store sensitive data).
It is all based on FreeBSD CURRENT, and therefore covers the usage of pkgbase. A touch of "how to implement the automation of this setup" shall also be shared during the talk.
Founded in 2021, The Armenian Bioinformatics Institute (ABI) is a research institute
focused on the development and application of computational data analysis
methods to human, plant, and bacterial genomics.
Like any other research institute, ABI needs servers to compute, storage to
store and networking to connect systems and data together.
While initially everything was a "house of madness" with mix of VMs on the
cloud, bare-metals with single user authentication and duct-taped networking,
the IT team decided to move everything to a FreeBSD backbone, with bhyve for
computing and data saved on ZFS.
In this talk we explore how we use FreeBSD in bioinformatics, how jails and
ZFS help us to maintain our infrastructure and critical, original data,
stories of issues we had over the last year (during my time), experiments in
the last 2-3 years (before my time), issues the lab encountered (before our
time) and problems we see till this day.
The talk also has a list of software that's needed by bioninformatics field
which are lacking on FreeBSD, bhyve/jails suggestions that would make our
lives easier and problems we encountered while trying to setup a FreeBSD-only
HPC environment.
Being an avid collector of Sun Microsystems servers, the speaker has a few Sun2 machines from around 1983. The 2/50 can only netboot but it doesn't use NFS as that had not been invented yet. But surely, a moden *BSD can act as a boot server and run a diskless client? And for the 2/120, that does have SCSI disks, it surely can be used to do a network installation of SunOS?
Well, maybe. Depending on the which flavour of BSD you are using, how much perseverance you have and probably also how the stars are aligned. The speaker will discuss his efforts netbooting a 40+ year old Sun as well. If you have some antique hardware in your attic, this talk is for you! Or just come to listen to some obstacles that were encountered in the process (FreeBSD kernel panic anyone?).
This talk describes the extended error messages that can now be returned by the FreeBSD kernel. This facility was added in May 2025 shortly before the release of 15.0. The goal was to reduce the terseness of commonly overloaded error codes like EINVAL which occurs at many places in a given system call. For example, the mmap(2) system call can return EINVAL for thirteen different reasons. The single terse error "Invalid argument" is now expanded with thirteen detailed error messages.
This talk will explain how the extended error facility has been added to the kernel, with a brief tutorial on how to incorporate its use into additional kernel subsystems. The talk will conclude by describing how the return and display of extended kernel error messages has been integrated into the err(3) error message system which is already used by many programs and utilities.
OpenNTPD hit the tree in 2004, so we're celebrating its 20th birthday (a few milliseconds late).
- motivation
- state of time sync back then
- initial design & implementation
- reception: a misunderstanding leading to a myth of inaccuracy
- considerable changes over 20 years - not just in ntpd, also in kernel timekeeping
Compared to C-lineage languages and associated build systems and mechanisms, many later languages starting with Perl have incorporated packaging systems for their own ecosystems. Language-based packaging systems are great for localised and isolated/containerised development involving the same language stack across different environments. They are not so great when interacting with operating system-level packaging systems like BSD Ports. Managing expectations between language communities and operating system communities is a large part of the work.
This programme focuses on and somewhat chronicles modernising the Python infrastructure on FreeBSD over this current decade (2020s). It is hoped that this at least partially shows why the process can take long.
Earlier this year I conducted a performance investigation and tuning of a slow backup job. Essentially, a single rsync syncing a deeply nested directory tree with thousands of files over the network onto a ZFS dataset on a remote server.
After a reboot of the remote server, the backup would be received and saved on a local filesystem in about 10 minutes. Unfortunately, as the uptime grew the rsync would run for days on end instead of minutes.
During the talk I will share with you how I figured out where rsync's bottleneck was and what I did to make the syncing finish within the expected timeframe of 10 minutes. I will show you what tools I used during the investigation to discover what parts of the system are screaming for help and to verify my hypothesis of where the root cause is.
We will explore tuning of caching on FreeBSD, ZFS performance metrics, and using DTrace to get a closer look at system's internals.
That's all Folks!
Have you ever come across a piece of software and wanted to try it out immediately? But the installation instructions are curl|sh which, besides security and safety concerns, only work on Linux and you happen to use FreeBSD? And building it from source code would require installing a bunch of dependencies?
Well, there is an obvious solution to all these problems: Use a VM! But how quickly can you get a VM up and running? With SSH properly configured. And the network. And a port exposed to the outside? This talk introduces a tool that does exactly that: create and configure temporary VMs in a low friction way.
Features include:
- Create temporary VMs running in-memory from templates.
- Automatic configuration of pf(4) for NAT, port forwarding, and strict filtering of outbound connections.
- Automatic setup of SSH (including proper configuration of the host keys): Just do "ssh tmp0" and you're connected!
This talk will also give insights into various challenges in the design process such as:
- How to coordinate between multiple instances without using a daemon?
- How to keep state to a minimum?
Developing and maintaining a robust software appliance requires modern tools and reliable processes. In this presentation, we will share our experience building PFWall, a software firewall appliance built entirely on FreeBSD at Orange.
We will detail our development pipeline, which leverages poudriere-image to generate reproducible, secure, and custom system images. We will demonstrate how our Infrastructure as Code (IaC) approach, orchestrated by GitLab-CI and Ansible, allows us to automate the entire lifecycle, from a code commit to the final image production and appliance configuration.
Finally, we will discuss our support model for an open-source product and how we interact with the FreeBSD community as a corporate entity. We will cover our process for reporting bugs and contributing to the ecosystem that makes our project possible.
Farewwell, Auction and 2027 reveal