now you can run net/chrony in a FreeBSD service jail: https://github.com/freebsd/freebsd-src/pull/1619

unfortunately it doesn't work with ntpd[0], for non-trivial reasons that i'm not really inclined to investigate since i don't use ntpd... but it seems like rc.d/ntpd sets some environment variables in its precmd that it expects to be available later in ntpd_start, but when svcj is enabled, that assumption doesn't hold, so ntpd ends up running without any command-line arguments.

but service jails seem pretty neat in general. i like that every service now has its own 'console' (stdout) log file under /var/log/svcj_${svcname}_console.log. hopefully in the future we can get some more fine-grained restrictions on services, like removing read/write filesystem access.

next task: get BIRD running with svcj. i suspect this might require some changes to permit a jail to modify the routing table. or at least, net_all doesn't say that it permits that.

[0] tested using this non-functional patch: https://github.com/llfw/freebsd-src/commit/cde92beb2713c3f30a81b9c69bd2545d723f930d