Numerous improvements have been made to x11appjail between version v1.0.0 and v1.3.1:

• Performance improvements in both x11appjail(1) and appscript-verify(1).
• Shallow builds to decouple the image from the AppJail.
• BLAKE3 support for faster file hash calculation.
• True hardware acceleration via VirtualGL.
• A new command, transfer, for securely transferring files between the host and a jail, or between jails.
• Many more examples added: Brave (Linux), Telegram Desktop, Thunderbird, Chromium, BadWolf, Evince, Feh, and Mpv. Evince, Feh, and Mpv are particularly interesting, as they demonstrate how AppJails can utilize existing files on the host, processing them within a FreeBSD jail transparently to the user.
• su-exec has been replaced by mdo(1).
• And much more.

This video demonstrates some of the aforementioned features.

Chapters:

[00:00] In the host

[01:24] Trusted key

[01:41] Htop

[02:13] Htop (jail) vs Htop (host)

[02:50] Firefox

[04:00] WebGL (no hardware acceleration)

[05:00] User permissions

[05:43] WebGL (hardware acceleration)

[07:22] Fonts

[07:55] Allowing webcam permission

[08:26] Firefox (hardware acceleration + webcam + fonts)

[10:27] Evince

[13:48] Evince (with Puck)

[16:27] Feh

[18:10] Feh and transfer command

[19:07] Mpv

[21:20] The End

cross posted. need some help with this

I am planning to install GhostBSD, dual boot on Windows 11-laptop.

What IDE/tools do you suggest for general development?

I've been running into some strange issues when trying to run a BSDD on my RPi 400 as of late:

• NetBSD was the first, and it just showed a blank screen

• FreeBSD gave me a rainbow screen (It works when i have the HDMI connection on HDMI1, however it seems like trying to run X11 is going to be a utter hassle…).

• I have tried OpenBSD and it doesn't seem to progress ahead of a all-blank screen after the u-boot screen.

In both cases of NetBSD and FreeBSD- they were the most recent stable versions available. I both had tried the official RaspberryPi imaging app and balenaEtcher, but they have not worked well for me… Is there i step i missed somehow in the process?

EDIT: 9:41pm Sep27 2026- Add notes about OpenBSD & FreeBSD

Finally, after a few months of experimentation, this week I decided to create a new tool based on what I've learned. And best of all: to honor the name of the main project, AppJail.

Initially, x11appjail was a project designed to leverage appjail-x11(1), an AppJail command for deploying an X server to run X11 applications inside a jail. However, this could be considered a "low-level" command, since executing an interactive application (TUI, CLI, GUI, etc.) requires completing specific stages for which this command is not designed. In the new version of x11appjail, these stages are documented in x11appjail-spec(5) but, in summary, they are: create, X, install, uninstall, and run.

To create a tool suitable for real-world use, I also had to improve some of the projects x11appjail depends on, such as appscript and unixexec. The following key improvements are worth noting:

• My goal with appscript is to create an ultra-lightweight alternative to AppImage for FreeBSD that does not rely on FUSE (thereby avoiding the need to configure vfs.usermount=1). In previous versions, the SFX would decompress its contents into a random directory upon every execution. This negatively impacts performance if the content is large. In the new version of appscript, processes operate cooperatively using exclusive and shared locks; consequently, the content is extracted only once (by the main or "leader" process) and removed only once (when the final process terminates).

  This is crucial for the new version of x11appjail, as it creates an AppJail from a specific AppJail image containing the application and its dependencies, which can result in a large AppJail in certain cases (i.e.: firefox).

• I take a more paranoid approach in this regard; therefore, one of the improvements made to unixexec is an option to not follow symlinks, given that using services (see SERVICES in x11appjail(1)) creates a unix(4) socket from the host to the jail.

• Another improvement to appscript is the ability to sign and verify AppScripts using the signify and sha256. This addition is essential, as x11appjail utilizes this functionality when running AppJails in portable mode.

After all this, and much more, the x11appjail tool was born:

x11appjail is a specialized tool for creating, verifying, installing, and running AppJails. An AppJail is a CLI, TUI or X11 application that runs inside a FreeBSD jail but is perceived by the end user as identical (or at least very similar) to an application running directly on the host system.

This tool makes extensive use of appjail(1) as its engine; however, unlike the latter, the primary user in x11appjail is neither root nor a privileged user, but rather an unprivileged user. The fundamental goal of this project is to grant the user limited access to the jail, restricted solely to the execution of a CLI, TUI or X11 application.

Project: https://github.com/DtxdF/x11appjail Port: https://freshports.org/security/x11appjail

Note: Keep in mind that this project requires the latest versions of appscript, unixexec, and appjail.