ZFS Is nullfs still the correct way to access a zfs dataset within a jail?

[puppydog]

I just thought I'd post here to make sure what I'm doing is actually the right way to do this.

On my host, I have a ZFS datset, data/shared. There are two relevant jails, jail1 and jail2. jail1 needs rw access to the dataset, and jail2 needs ro access. In this situation jail1 contains the service that creates the files originally, and jail2 (and others) just read the files without modifying them.

in jail.conf, I will have the following (with unrelated items redacted):

jail1 {
allow.mount.nullfs;
mount.fstab="/etc/fstab.jail1";
path="/jails/jail1";
}

jail2 {
allow.mount.nullfs;
mount.fstab="/etc/fstab.jail2";
path="/jails/jail2";
}

And the two fstab files are as follows:

/etc/fstab.jail1:

/data/shared /jails/jail1/shared nullfs rw 0 0

----

/etc/fstab.jail2:
/data/shared /jails/jail2/shared nullfs ro 0 0

Now, as far as I understand, this should be everything I need for a basic shared configuration without opening up any unexpected security holes, correct? I'll need to ensure that UID and GIDs are appropriately assigned within each relevant jail to ensure correct permissions, but besides that this is everything? Or am I overlooking anything?

 

[im]

Nullfs should be a good solution for your case.

I used nullfs to mount the read only /usr/ports from the host to jails.
Also I use nullfs to mount a directory with some data to the two jails at the same time.
It works fine.