October 27, 2025

The FreeBSD Foundation is pleased to announce that it has completed work to build FreeBSD without requiring root privilege. We have implemented support for all source release builds to use no-root infrastructure, eliminating the need for root privileges across the FreeBSD release pipeline. This work was completed as part of the program commissioned by the Sovereign Tech Agency.

The changes are currently available in the FreeBSD development branch and, where possible, are being merged into the release branch for FreeBSD 15.0.

Building FreeBSD release artifacts no longer requires root access to create device files, set proper ownership, and mount file systems during the build process. This has improved security and made automated builds simpler.

Now, every FreeBSD release artifact can be built without root privileges:

  • Dual-mode ISO images for USB flash drives and CD/DVD installation media
  • Memstick images for bootable USB drives
  • VM images for virtual machine deployment
  • Cloud disk images for AWS, Azure, and other cloud platforms

Removing the need for root privileges in the build pipeline has reduced the attack surface and potential for privilege escalation. It enables safer and more flexible build environments, both for official infrastructure and for community contributors.

Reproducible Builds

In parallel with the no-root work, FreeBSD has introduced several changes to improve build reproducibility – ensuring that identical source inputs always produce identical binary outputs, byte-for-byte. These changes span the operating system itself, the release tooling, and the build process.

Key improvements include:

  • Elimination or normalization of timestamps
  • Stable ordering of file lists, package metadata, and similar data
  • Consistent build environments, including debug paths and locale settings
  • Reproducible artifact support in build tools such as the file system image creation utility mkimg(1)

Reproducible builds strengthen the integrity and transparency of the entire software supply chain. They enable verifiable trust, improved debugging and auditing, simplify continuous integration, and support long-term maintainability.

FreeBSD continuous integration systems and automated build infrastructure can now operate in unprivileged containers and restricted environments. Contributors can also now build complete FreeBSD releases on their local systems without elevated privileges.

FreeBSD now builds safely, reproducibly, and without root. It’s faster, more secure, and more transparent – ready for anyone, anywhere, to build with trust.