IME, the base-system jail stuff is super easy to understand, use, and customize. When you start using "easy" tools on top of that, it rapidly becomes more compl

IME, the base-system jail stuff is super easy to understand, use, and customize. When you start using "easy" tools on top of that, it rapidly becomes more complicated and opaque for non-trivial stuff. It's awesome that you can do everything you would want with a jail with only 3 config files: rc.conf (for networking and start-up), pf.conf (for firewalling/routing), and jail.conf (for specifying jail params like mount points, network if setup, etc.). Super clean, super easy.