immich {
  vnet;
  persist;
  exec.clean;
  allow.raw_sockets;
  mount.devfs;
  allow.mount;
  allow.mount.devfs;
  allow.mount.linprocfs;
  allow.mount.linsysfs;
  allow.mount.tmpfs;
  allow.mount.nullfs;
  enforce_statfs = 1;

  devfs_ruleset = 4;
  host.hostname = "${name}";
  path = "/usr/local/jails/containers/${name}";

  exec.start = "/bin/sh /etc/rc";
  exec.stop  = "/bin/sh /etc/rc.shutdown";

  # Networking
  exec.prestart  += "jail_net prestart  {{ jail_num }} ${name}";
  exec.poststart += "jail_net poststart {{ jail_num }} ${name}";
  exec.prestop   += "jail_net prestop   {{ jail_num }} ${name}";
  exec.poststop  += "jail_net poststop  {{ jail_num }} ${name}";

  # nullfs mounts
{% for mount in nullfs | default([]) | normalize_nullfs %}
  mount += "{{ mount.src }}  ${path}{{ mount.dst }}  nullfs  {{ mount.mode | default('rw') }}  0  0";
{% endfor %}
{% for img in oci_images %}

  # Mounts for {{ img.name }} rootfs
  mount += "linprocfs $path/image/{{ img.name }}/proc  linprocfs rw 0 0";
  mount += "linsysfs  $path/image/{{ img.name }}/sys   linsysfs  rw 0 0";
  mount += "devfs     $path/image/{{ img.name }}/dev   devfs     rw 0 0";
  mount += "tmpfs     $path/image/{{ img.name }}/tmp   tmpfs     rw 0 0";
  mount += "tmpfs     $path/image/{{ img.name }}/run   tmpfs     rw 0 0";
{% endfor %}
}