Docker vs jails, the honest comparison

Every six months the same debate resurfaces : FreeBSD jails supposedly crush Docker on efficiency and we should all feel guilty for having picked containers. The case isn’t entirely wrong, it even makes a few valid points, but those points end up buried under selective comparisons and misleading metrics.

I’ll take the arguments one by one, because telling legitimate criticism apart from misdirection seems more useful than defending a camp.

What is true and worth acknowledging

Default images are bloated and nobody serious will claim otherwise. Layer caching requires discipline and without that discipline you do pile up useless layers. As for Docker Desktop licensing, it’s a legitimate enterprise concern and I honestly wonder who still pays for that.

These three criticisms hold up. The trouble starts when they get mixed with numbers that mean nothing.

The 5.3 GB daemon, or the art of citing the wrong column

We keep getting shown a Docker daemon that supposedly eats 5.3 GB. Except that’s virtual memory, not RSS. A process can reserve gigabytes of virtual address space while consuming only a fraction of resident RAM and that’s the normal behaviour of just about everything running on a modern system.

Citing VIRT instead of RSS is either ignorance or deliberate misdirection. Either way, the figure proves nothing.

150 MB per image, a choice and not a flaw

Next comes the 150 MB of a default container set against the few megabytes of a jail, as if Docker forced that size on you. Alpine fits in 150 MB, the default image in 1 GB, but that’s a user choice, not a Docker flaw. Better yet, multi-stage builds exist precisely for this : the tooling is there and not using it is on you, not on the engine. [edit: 2026] You can also have FROM scratch images which, for standalone binaries, contain nothing but the binary itself and so weigh almost nothing; llmp2p is one example, a static Go binary alone in the image. On hardening an image and putting it on a diet, see my notes on Docker hardening and rootless mode .

As for the 4 MB per jail versus 150 MB per container, the comparison is dishonest in its very premise. A jail shares a base system already installed on the host. A container bundles its dependencies explicitly, so it stays reproducible on any machine. That apparent redundancy is the feature, not the bug.

Jails have existed since 2000 and yet

The seniority argument always comes back : jails have been around since 2000, long before containers were fashionable. True and the industry chose containers anyway. Why ?

Because jails are FreeBSD-only. No ecosystem, no image registries, no standard CI/CD integration, no cross-platform portability. Technical elegance means nothing without adoption and adoption is built on an ecosystem, not on an isolated feat.

We also hear about cold starts in milliseconds. A cached container starts in milliseconds too and the initial pull time is comparable to installing a FreeBSD base system. The advantage evaporates the moment you measure the same thing on both sides.

Asking the real question

At bottom the debate isn’t Docker versus jails. The question that matters is : what level of isolation, portability and ecosystem support does your use case actually require ?

Pitting a mature, cross-platform ecosystem against a single-OS technology and then declaring victory on a memory-footprint metric is like praising a bicycle for using less fuel than an aircraft. Technically true and entirely missing the point.

FreeBSD jails are excellent. On FreeBSD, for FreeBSD workloads, managed by people who know FreeBSD. For everything else, there’s a reason the industry moved on. The container ecosystem didn’t ignore security or efficiency, it solved them differently, with portability as a first-class constraint rather than an afterthought.

For those who want stronger isolation without giving up the ecosystem, projects like Kata Containers or Firecracker-style micro-VMs (which I covered in Firecracker isolation ) already combine the advantages of virtual machines and containers, aiming at better workload isolation while keeping the speed of traditional containers. That’s where the real discussion happens, not on a misread column of htop .

So, which one?

A memory figure means nothing until you say whether it’s VIRT or RSS.
Image size is a build choice, not a fate imposed by Docker.
A jail shares the base system, a container bundles its dependencies to stay reproducible and that’s exactly what we ask of it.
Technical elegance doesn’t survive without an ecosystem, registries and portability.
The right question isn’t the tool, it’s the level of isolation, portability and support your use case needs.

[edit: 2026] The Ansible implementation of all this: the docker and podman roles.