FreeBSD is a free, open-source Unix-like operating system descended from the BSD software developed at the University of California, Berkeley. It is used for web and network servers, firewalls and routers, storage systems, embedded devices, development machines and desktops. FreeBSD runs on 64-bit x86, ARM, AArch64, RISC-V and 64-bit PowerPC hardware. Ready-made images are available on cloud platforms such as Amazon EC2 and Google Compute Engine. A volunteer community maintains it with funding support from the nonprofit FreeBSD Foundation.
One complete base system
Linux distributions assemble a kernel and separately developed tools. FreeBSD develops the kernel, the device drivers, the core command-line utilities, the system libraries and a C/C++ compiler and debugger together, in a single source repository. This collection is called the base system, and it is released, versioned and updated as one unit.
The practical result is that the parts of a FreeBSD installation that keep the machine running always match each other. Manual pages document it down to individual drivers and kernel interfaces. A unified build system can rebuild the entire operating system from source. This is also why companies use FreeBSD as the foundation for their own appliances and products.
Packages and the Ports Collection
Software outside the base system, such as web servers, databases, languages and desktop environments, comes from the Ports Collection. Each port is a set of build instructions for one program; the build fetches the original source code, applies FreeBSD-specific patches and compiles it. Building from ports lets an administrator change compile-time options, for example to leave out a feature or link against a different library.
Where feasible, a port is also offered as a ready-made binary package. Most software can therefore be installed, upgraded and removed with the pkg package manager without compiling anything.
ZFS storage and boot environments
FreeBSD includes OpenZFS, a combined volume manager and file system, and its installer can place the whole system on ZFS. Disks are grouped into a storage pool built from single disks, mirrors or RAID-Z groups. File systems called datasets draw space from that pool instead of from fixed partitions. Each dataset has its own compression and quota settings.
Every block ZFS writes carries a checksum. ZFS verifies it when reading the data. On a mirror or RAID-Z pool, ZFS automatically repairs a block that fails the check from a good copy. A scheduled scrub reads the whole pool to find silent corruption. Snapshots record a dataset at a moment in time and initially use almost no space. They can be browsed, compared, rolled back or turned into writable clones. Snapshots can be replicated to another machine, incrementally if needed.
Boot environments build on the same snapshot mechanism. A bootable copy of the current system can be kept before an upgrade and booted again if the upgrade fails.
Jails for isolating services
Jails are FreeBSD’s form of operating-system-level virtualization. A jail has its own view of the file system, its own users and processes, and either shared or dedicated network access. A compromised service inside a jail therefore has limited reach into the host. Jails share the host kernel and cannot run a newer FreeBSD release than the host.
FreeBSD supports several kinds of jails:
- Thick jails contain a full copy of the base system and are the most independent, at the cost of more disk space and separate updates.
- Thin jails share a base system template, either as ZFS clones or as a read-only mount that updates every jail at once.
- Service jails confine a single daemon while reusing the host’s file system and accounts.
- VNET jails get a separate network stack with their own interfaces, routing tables and firewall rules.
Jails are defined in a configuration file and can start automatically at boot.
Virtual machines with bhyve
For full virtual machines, FreeBSD includes the bhyve hypervisor in the base system. A bhyve host can run FreeBSD, OpenBSD, many Linux distributions and Microsoft Windows as guests. FreeBSD also runs as a guest under VirtualBox, VMware Fusion, Parallels Desktop and QEMU.
Running Linux programs
FreeBSD can run many unmodified Linux binaries directly, without a virtual machine, through its Linux binary compatibility layer on x86 and AArch64. Once the kernel support is enabled, statically linked Linux programs run as they are. Most dynamically linked ones also need a Linux userland. This can be installed as a package based on Rocky Linux or set up as a Debian or Ubuntu tree. The compatibility layer does not provide Linux-specific system-management features such as cgroups and namespaces.
Networking, firewalls and security
The FreeBSD network stack implements standard TCP/IP for IPv4 and IPv6. The system is widely used for routers, DNS servers, NAT gateways and packet-filtering firewalls. Three firewalls ship in the base system:
- PF, originally from OpenBSD, with stateful filtering, NAT and optional traffic queuing through ALTQ.
- IPFW, a stateful firewall for IPv4 and IPv6 with in-kernel NAT and the dummynet traffic shaper.
- IPFILTER, a cross-platform firewall with NAT and stateful rules.
Beyond firewalls, FreeBSD offers a Mandatory Access Control framework for policies stricter than standard file permissions. It also offers Capsicum, a capability system that lets a program give up access to everything except the files and sockets it actually needs.
Desktop use
FreeBSD runs graphical desktops on the X Window System or Wayland. KDE Plasma, GNOME, Xfce, MATE, Cinnamon and LXQt can each be installed as packages along with a display manager. The same package collection supplies browsers, office suites and development tools. Machines can also boot diskless from a central server.
Updates and release branches
FreeBSD separates patches from upgrades. The freebsd-update tool downloads and installs security and errata fixes for a release as binary updates. It can also move a system to a newer minor or major release and roll back the last set of changes. Alternatively, the base system can be rebuilt from an updated source tree.
Development follows three tiers. Release branches receive only critical fixes and are meant for most users. Stable branches collect tested ongoing changes for the next release. The main development branch, known as CURRENT, carries the newest code for developers and testers.
BSD license and project model
FreeBSD is distributed mainly under the permissive BSD license. Anyone can modify the source and include it in open-source or closed commercial products without having to publish their changes. This is why FreeBSD code appears inside many third-party products. A small number of components in the source tree carry the GPL or LGPL instead. An elected core team sets the project’s direction.
