TIL you can nullfs mount a #ZFS snapshot. This could be particularly useful for making sure jail root filesystems are absolutely 100% immutable: hbsd-current-02[shawn]:/home/shawn $ uname -a FreeBSD hbsd-current-02 16.0-CURRENT FreeBSD 16.0-CURRENT #0 hardened/current/master-n196551-d4411c7c9cc3-dirty: Wed Sep 16 19:42:46 UTC 2026 shawn@hbsd-current-02:/usr/obj/usr/src/amd64.amd64/sys/HARDENEDBSD amd64 hbsd-current-02[shawn]:/home/shawn $ sudo mount -t nullfs /usr/ports/.zfs/snapshot/2026-07-24_before /mnt $ ls -l /usr/ports | head -n 5 total 3215 -rw-r--r-- 1 shawn shawn 149175 Oct 7 00:59 CHANGES -rw-r--r-- 1 shawn shawn 727 Apr 26 18:13 CONTRIBUTING.md -rw-r--r-- 1 shawn shawn 1412 Apr 26 18:13 COPYRIGHT -rw-r--r-- 1 shawn shawn 13370 Oct 1 18:46 GIDs hbsd-current-02[shawn]:/home/shawn $ mount | grep nullfs /usr/ports/.zfs/snapshot/2026-07-24_before on /mnt (nullfs, local) hbsd-current-02[shawn]:/home/shawn $ touch /mnt/blah touch: /mnt/blah: Read-only file system hbsd-current-02[shawn]:/home/shawn (1) $ echo ohai > /mnt/README zsh: read-only file system: /mnt/README #FreeBSD #HardenedBSD #infosec #OpenZFS