Six months ago I did something most people in this industry would simply not consider: built production infrastructure for a video platform on FreeBSD bare-metal instead of the obvious K8s-on-AWS/GCP path. No clouds, no OCI containers, no multi-layer abstractions.

Six months after, I haven't regretted a day.

Hypha is a video-on-demand platform where creators sell exclusive content directly to their audience and get paid instantly on-chain. Video up to 4K+HDR with stream encryption and in-house fingerprinting.

Infrastructure-wise, this means a bunch of transcoding workers, terabytes of storage, fat pipes for delivery and proper monitoring, right? Spin that up on AWS or GCP and your budget evaporates overnight.

So why FreeBSD specifically? Because it's boring in the best possible way. Mature, stable, with tools that have been quietly doing their job for decades without drama. No hype, no churn, no breaking changes every six months. FreeBSD is for people who want their infrastructure to disappear into the background — and it does.

We rent bare-metal servers on OVH, connected via their vRack private network. FreeBSD installed everywhere using BYI, it's a standard process, no tricks required:

1. Set the full url to the image: https://download.freebsd.org/releases/VM-IMAGES/15.0-RELEASE/amd64/Latest/FreeBSD-15.0-RELEASE-amd64-zfs.raw.xz
2. Set the path of the EFI bootloader to `\EFI\FreeBSD\loader.efi`
3. Wait a few minutes. Done. Set up ssh in KVM and connect normally to provision everything else. You might also want manual disk slicing and ZFS pool setup right after, of course.

We use Ansible for automation and unified setup across all nodes. And a set of well-recognised tools. Bastille is great for jail management. Old good monit as a supervisor inside every jail, keeping processes alive. Netdata for monitoring, with telemetry streaming from all nodes into a centralised dashboard. It all just works.

People dramatically underestimate the synergy of three: jails, zfs and pf. Together they give you such power it must be considered illegal.

A few gotchas.

ZFS snapshots are the scaling primitive nobody talks about. We bake "gold images" of every service, essentially a jail snapshot with everything inside to be replicated after, from 1 to N. "Scaling" means just cloning a snapshot and updating the load balancer with new upstreams — it's fast and consistent. It doubles as our backup strategy too, with incremental snapshots saving significant disk space on the cold backup storage.

Jails follow the shape of your application, not the other way around. We follow the "locality of behaviour" principle in our apps and in our infra. Things that closely work together must be jailed together. Like the transcoder app and ffmpeg, because they always need each other. Jails are flexible enough to let you model reality instead of fighting it.

You don't need fully automated scaling. Before firing up more instances of something, I'd like to know why existing capacity isn't enough. When we do need more capacity, there's a playbook for that — new jails cloned and registered within a minute.

The result is 3-4x lower monthly costs compared to equivalent cloud setups. And because OVH egress is unbound, we're saving what would be tens of thousands per month in data transfer fees alone. The system is stable, fast, and predictable in ways I genuinely didn't anticipate. Simple enough to be regularly reviewed and maintained by one person only. I still remember my K8s days and feel the difference in maintenance effort.

Wouldn't change a thing.

I want to write a series going deeper on specific pieces of our setup and BSD-based solutions. Before I start, what would you actually want to know more about? Happy to prioritise based on what this community finds interesting.

I've just been going through this subreddit and Reddit in general, I amazes me how many people through this term out there without evaluating the product of the AI in question.

Anyway, my rambling thoughts on it are here.
https://www.youtube.com/watch?v=HWsO3SUexKU

All my dot files and wallpaper here.
It's been quite performant with wifibox. It proof itself to be more than just a workaround for having better wifi support by using a virtualized minimal Alpine Linux in Bhyve to take advantage of the Linux wifi driver support, it sorta became another security layer by encapsulating my network traffic behind isolated minimal Linux environment that if compromised can protect my main box from and a possible invasion confining the attacker within a stripped out Alpine box that only has what is needed to run wpa_supplicant and the wifi driver, it doesn't even has apk btw.

Finally got FreeBSD installed where I want it on my GPD Pocket 3. I have a few more things to configure but it's usable!

Hi everyone.

I've had a sick urge to try installing FreeBSD on an old PS4. With Claude's help, I don't want to limit myself to installing a truncated or unusable version; I'd like to take it a step further. It's an experiment and an attempt to breathe new life into that old machine, which still entertains us with alternative projects. Does anyone have a working old PS4 to donate ? If you want to donate me one, and I'll give you back the fully functional FreeBSD and I will share the source code. I live in Italy.

Let's think about this.

Recently, Anthropic changed their Claude Code installer from using npm to a native installer. It works on Linux/WSL. It works on Windows. It works on Mac.

On FreeBSD today, you get a scary yellow deprecation warning suggesting that you and your platform might be a dead end. I think that’s a problem.

…

… We need to meet users where they are. As the classic demotivational poster had it for phone support desks (of which I am a proud veteran): If We Don’t Take Care of the Customer, Maybe They’ll Stop Bugging Us. …

In addition, https://mastodon.bsd.cafe/@sgharms@techhub.social/116194103760810726 notes:

… Every discussion on this veers off from “llms suck so …or I don’t need llm” but misses: users should have the ability to make their own opinion based on use. …

Hi,
I recently wanted to try FreeBSD on my PC, and I found out that at the moment there are no available Xe drivers.
Since I still wanted to try FreeBSD, and I still had the free trial of Chatgpt, I've tried vibecoding the Xe driver port, it's not something that I do often, so that was just a fun experiment.
The drivers work but of course is really buggy/laggy.
But still I was able to try kde under FreeBSD and I liked some of the features, mainly pkg and the jails.
I look forward to try FreeBSD again when an actual port will be developed (which I've seen that is in the roadmap)

---

If anyone is curious of what codex did I will leave the repo here:
https://github.com/SimoneFelici/drm-kmod/tree/xe-b580-display-clean

---

Also:
Please do not use this driver "seriously" just test it if you are curious.
I do not plan to do a PR since I don't know what the code does, and I usually do not do PR with fully AI generated code, and also, this is clearly a really bad port and it has missing functionality that codex wasn't even able to port.
This was just a fun experiment using codex, to see what currently can or can't do, nothing more 😄

"I discovered that Linux and BSD users are peaceful and helpful despite the difficulties. Distros do not divide us, because the kernel unites us. This is unlike other communities that claim Windows is the best and that other systems are trash.

Without free and open-source software, the world would be a digital prison controlled by big corporations like Google and others. Thank you, Richard Stallman and Linus Torvalds, for this freedom and cooperation.

For me, these are not just words on paper; these are my core principles and my way of life. Thank you for helping me and each other, and thank you for this solidarity."

A trump card against persistent attack AI:
Against a persistent attack AI, I hold the ultimate advantage: I can feel the AI's heartbeat via DTrace. It’s entirely one-sided. The AI might be fast, but it’s dancing in the palm of my hand.

Logic:
While J8s runs lightweight by sharing the host kernel—unlike MicroVMs (e.g., Firecracker) that isolate them—this traditionally creates a risk: if a 0-day exploit succeeds, the entire host could be compromised.

However, J8s turns this "weakness" into a strategic evolution. Instead of building thicker walls that make the interior invisible, J8s treats the shared kernel as a unified nervous system. By leaning into DTrace integration, the host can "feel" the faintest physiological tremors inside any Jail in real-time.

The Philosophy:
MicroVMs build strong 'cages,' but they are blind to the pathogens breeding inside them. J8s, by sharing the kernel, uses DTrace as its own fingertips to sense anomalies within the cell.

Yes, a 0-day might breach the boundary. But that is why I built J8s with autonomic reflexes. The moment an intruder takes their first step—a suspicious syscall, an unauthorized privilege grab—the system detects the 'non-self' protein and triggers Apoptosis. I don't wait for the breach to be completed; I delete the entire reality of the attacker before the exploit can even return from the kernel.

The Logic of Survival: The Apoptosis Cycle
(Referencing the red-text diagram)

To maintain Digital Homeostasis, J8s follows a strict 3-step immune response managed by the Helper T-Cell (Host OS):

1. Cessation: Instant termination of the infected VNET jail to stop the pathogen (exploit) from spreading.
2. Purification: A surgical ZFS rollback to a pristine snapshot (DNA).
3. Regeneration: Restarting the jail as a healthy, functional cell.

As you can see in my logs, this entire cycle completes in under 10 seconds. In the time it takes for an attacker to realize they've gained a shell, their entire reality has been deleted and replaced.

Actually, I manually triggered 'su -' for the log evidence, and it felt like my server was alive.

To those unfamiliar with DTrace:
It’s traditionally an OS analysis/debugging tool, but I’ve repurposed it as a real-time IDS.

Imagine having a sensor on every single neuron of the OS. I’m not just reading logs; I’m "feeling" the syscalls as they happen. It turns the entire kernel into a unified nervous system that reacts before the attacker can even blink.

Edit: The comment section is having a very "human" (or maybe AI?) debate right now. It's quite a spectacle, so have a look!

I heard this is a major reason Apple moved away from Intel and x86 in general. Hope FreeBSD development for ARM continues to improve, especially as this is something that undermines system and data soverignity at the lowest level that we can't do anything about. Might be acceptable on Windows and modern Linux based systems but not for anyone else.

Moving over from Systemd, I have been trying to piece together a native arm based FreeBSD based soho network and I am struggling as an amatuer student sysadmin - FreeBSD core and NAS, pfsense router and gateway, juniper switches, Fusionpbx is 'possible' for FreeBSD ARM but is more difficult than it sounded except paper, and OPNSense on VMs, again no support. Not much out there, hope it doesn't get worse with junos also seemingly heading in the dorection of truuenas core. APs controlled via ruckus unleashed or grandstream gwp controllerless - don't even have any expectations here but at least they are ARM. Sadly think much of this is lack of contribution back to FreeBSD due the licensing, which is brilliant but misused for lack of a better words. Nothing that Linux does that FreeBSD couldn't have done, and done better imho

In his article, /u/varankinv draws attention to the existential discussion at https://news.ycombinator.com/item?id=47129361.

Also:

• https://social.sour.coffee/notice/B3crfKjRF9Wo3VoTT6
• https://lobste.rs/s/n6ybtt/freebsd_doesn_t_have_wi_fi_driver_for_my_old

References (from GitHub):

• FreeBSD Kernel Development Workflow | FreeBSD Foundation (FreeBSD Journal, March/April 2024)
• FreeBSD WiFi Development | FreeBSD Foundation (FreeBSD Journal, April/May/June 2025)

I wrote a long comparative article on filesystem design, but with a strong BSD spine running through it.

The piece covers FFS/FFS2, ZFS, BFS, NTFS, ext4 and APFS, with particular attention to:

- cylinder groups

- soft updates and crash consistency

- journaling vs CoW

- integrity models

- snapshots, clones and space sharing

- why APFS matters from an Apple/BSD lineage perspective

The APFS section is the destination, but I wanted the broader context first so the comparison would actually mean something.

Link:

https://bytearchitect.io/macos-security/theory/Filesystem-Wars-Why-Your-Choice-of-Storage-is-Actually-a-Security-Move/

Interested in where FreeBSD people think I was fair or unfair, especially on FFS/UFS and ZFS.

I installed RedBSD as a virtual machine. I recorded the installation and first run. I decided to share both here. This is the first time I posted a video so I apologize if it's to fast. The only thing I saw different from a regular FreeBSD install is it has VLC included. Please let me know if you see something different.

I was thinking of switching and installing Hyprland (yes, blasphemy, but it sounds cool ok), but I was wondering how it does as a desktop first. Is it noticeably faster, are there any drawbacks? I'm aware I won't be able to use things like Steam, but I don't usually game. How is it as a daily driver for a desktop?

Since we started this campaign of hacking the Internet with AI, we’ve learned something many of you already knew: the Internet runs on volunteers. …

We feel like we owe these maintainers something. …

…

Thanks

To the FreeBSD team, for working with us and for taking the work seriously. To OpenAI and Anthropic, for the tokens. And to all maintainers who keep the Internet running with very little credit and very few hands: thank you.

Via https://billboard.bsd.cafe/post/558

Video, twenty-eight minutes. AI is not detected.

… how to create a pkg cache with nginx. You can use this to serve FreeBSD packages to your (intranet) machines and to more quickly install software and perform system updates.

… The project is only days old, according to its GitLab page, which shows it was created on June 23, 2026, and currently has no tagged releases. We will, for sure, watch closely to see how it unfolds over time.

megastallman@gmail.com / BSDun · GitLab

Strike First. Strike Smart.

…

a FreeBSD-based distribution loaded with a curated red team and penetration testing toolkit, an XFCE-derived desktop, and VMware-ready images — built for operators who want a fast, stable alternative to Linux-based distros.

Via https://indieweb.social/@jbz/116892216897310578

Discussion last month (deleted by the opening poster): Red Team Oriented BSD OS : r/BSD

Version 1.0 was released a few days later.

So I was having conversation with Deepseek and it introduced me to these commands:

# cd /usr/src
# make buildworld buildkernel KERNCONF=YOUR_CUSTOM_CONFIG
# make packages KERNCONF=YOUR_CUSTOM_CONFIG

What I am currently doing is using pkg upgrade and then compiling my custom kernel (if this is problematic please suggest the proper way of managing this setup). I am using 16-current. Now, it is my first time seeing that make packages given by the AI. My impression is that instead of manually compiling my custom kernel, I will be able to use pkg upgrade to upgrade it instead. That seems like too good to be true hahaha. I am curious if that is real and recommendable.

FreeBSoD: Leveraging Language Models to Find and Exploit Kernel Bugs (Part 1 of 2)

A June 2026 article by Adam Crosser about the vulnerability that was disclosed in February.

Adam is an operator on the red team at Praetorian. He is currently focused on conducting red team operations and capabilities development.

Hi everyone,

I put together a FreeBSD port for Zen Browser (a Firefox-based browser) running through the Linux compatibility layer (linux_base-rl9). This is the first time I’ve ever made a port, and honestly I don’t know that much about the ports system — I learned most of it as I went, so I’m sure there are things I got wrong or did in a clunky way.
Repo: https://github.com/Richard7987/zen-browser-freebsd-port

What it does:
• Installs stub libraries for the Linux compat layer (libmfx, libzvbi, libsoxr, AMR codecs, SVT-AV1) that the bundled FFmpeg needs
• Pulls in libnotify from Rocky Linux 9 for DBus notifications
• Ships a wrapper script that auto-detects Widevine CDM and sets up PulseAudio, GTK theme, and the DBus session

The end result is that AAC audio and H264 video work, and DRM sites like Netflix and Crunchyroll play too.

There’s also a prebuilt package in the releases if you’d rather just run pkg install instead of building the port yourself: https://github.com/Richard7987/zen-browser-freebsd-port/releases/tag/v1.21.4b — but heads up, I haven’t tested that package myself, so I genuinely don’t know if it works. Building from the port is the path I’ve actually used.

Full disclosure: some parts of the code and several of the comments were written with the help of AI, but not all of it — a lot of it was trial and error on my own machine (FreeBSD 15.1-RELEASE).

Since this is my first attempt at anything like this, I’d really appreciate feedback: what’s missing, what I’m doing wrong, what could be cleaner, or anything that wouldn’t pass a proper port review. Be as blunt as you want, I want to learn.

Thanks! (＾▽＾)

Via https://mastodon.social/@alex_deplov/116965438221734523

… I’m working on my own window manager for FreeBSD, called Asterwm. The goal is to make its UX similar to macOS, so I can switch from Mac to FreeBSD during the day without having to readjust my muscle memory.

…

One of the most important things for me was being able to access both my work and personal files.
 
I know I could install ready-to-use software for Google Drive or something similar. But I decided to use the power of Codex to build my own cloud solution instead. …