{% set devfs_ruleset = 4 -%}
{{ jail.name }} {
  vnet;
  exec.clean;
  allow.raw_sockets;

  mount.devfs;        # Mount /dev according to devfs_ruleset
  devfs_ruleset = {{ devfs_ruleset }};

  enforce_statfs = 1; # Let jail see own mounts

  host.hostname = "${name}";
  path = "/usr/local/jails/containers/${name}";

  exec.start = "/bin/sh /etc/rc";
  exec.stop  = "/bin/sh /etc/rc.shutdown";

  # Networking
  exec.prestart  += "jail_net prestart  ${name} {{ jail.num }} {{ jail.ip }}";
  exec.poststart += "jail_net poststart ${name} {{ jail.num }} {{ jail.ip }}";
  exec.prestop   += "jail_net prestop   ${name} {{ jail.num }} {{ jail.ip }}";
  exec.poststop  += "jail_net poststop  ${name} {{ jail.num }} {{ jail.ip }}";

  # nullfs mounts
{% for mount in jail.nullfs %}
  mount += "{{ mount.src }}  ${path}{{ mount.dst }}  nullfs  {{ mount.mode | default('rw') }}  0  0";
{% endfor %}
{% for img in oci_images %}

  # Mounts for {{ img.name }} rootfs
  mount += "devfs     $path/image/{{ img.name }}/dev   devfs     rw,ruleset={{ devfs_ruleset }}   0   0";
  mount += "linprocfs $path/image/{{ img.name }}/proc  linprocfs rw             0   0";
  mount += "linsysfs  $path/image/{{ img.name }}/sys   linsysfs  rw             0   0";
  mount += "tmpfs     $path/image/{{ img.name }}/tmp   tmpfs     rw             0   0";
  mount += "tmpfs     $path/image/{{ img.name }}/run   tmpfs     rw             0   0";
{% endfor %}
}