.\" SPDX-License-Identifier: CDDL-1.0
.\"
.\" This file and its contents are supplied under the terms of the
.\" Common Development and Distribution License ("CDDL"), version 1.0.
.\" You may only use this file in accordance with the terms of version
.\" 1.0 of the CDDL.
.\"
.\" A full copy of the text of the CDDL should have accompanied this
.\" source.  A copy of the CDDL is also available via the Internet at
.\" https://opensource.org/license/CDDL-1.0.
.\"
.\" Copyright (c) 2009 Sun Microsystems, Inc. All Rights Reserved.
.\" Copyright 2011 Joshua M. Clulow <josh@sysmgr.org>
.\" Copyright (c) 2011, 2019 by Delphix. All rights reserved.
.\" Copyright (c) 2011, Pawel Jakub Dawidek <pjd@FreeBSD.org>
.\" Copyright (c) 2012, Glen Barber <gjb@FreeBSD.org>
.\" Copyright (c) 2012, Bryan Drewery <bdrewery@FreeBSD.org>
.\" Copyright (c) 2013, Steven Hartland <smh@FreeBSD.org>
.\" Copyright (c) 2013 by Saso Kiselkov. All rights reserved.
.\" Copyright (c) 2014, Joyent, Inc. All rights reserved.
.\" Copyright (c) 2014 by Adam Stevko. All rights reserved.
.\" Copyright (c) 2014 Integros [integros.com]
.\" Copyright (c) 2014, Xin LI <delphij@FreeBSD.org>
.\" Copyright (c) 2014-2015, The FreeBSD Foundation, All Rights Reserved.
.\" Copyright (c) 2016 Nexenta Systems, Inc. All Rights Reserved.
.\" Copyright 2019 Richard Laager. All rights reserved.
.\" Copyright 2018 Nexenta Systems, Inc.
.\" Copyright 2019 Joyent, Inc.
.\" Copyright 2021 Klara, Inc.
.\"
.Dd July 11, 2022
.Dt ZFS-ZONE 8
.Os
.
.Sh NAME
.Nm zfs-zone ,
.Nm zfs-unzone
.Nd attach and detach ZFS filesystems to user namespaces
.Sh SYNOPSIS
.Nm zfs Cm zone
.Ar nsfile
.Ar filesystem
.Nm zfs Cm unzone
.Ar nsfile
.Ar filesystem
.
.Sh DESCRIPTION
.Bl -tag -width ""
.It Xo
.Nm zfs
.Cm zone
.Ar nsfile
.Ar filesystem
.Xc
Attach the specified
.Ar filesystem
to the user namespace identified by
.Ar nsfile .
From now on this file system tree can be managed from within a user namespace
if the
.Sy zoned
property has been set.
.Pp
You cannot attach a zoned dataset's children to another user namespace.
You can also not attach the root file system
of the user namespace or any dataset
which needs to be mounted before the zfs service
is run inside the user namespace,
as it would be attached unmounted until it is
mounted from the service inside the user namespace.
.Pp
To allow management of the dataset from within a user namespace, the
.Sy zoned
property has to be set and the user namespaces needs access to the
.Pa /dev/zfs
device.
The
.Sy quota
property cannot be changed from within a user namespace.
.Pp
After a dataset is attached to a user namespace and the
.Sy zoned
property is set,
a zoned file system cannot be mounted outside the user namespace,
since the user namespace administrator might have set the mount point
to an unacceptable value.
.It Xo
.Nm zfs
.Cm unzone
.Ar nsfile
.Ar filesystem
.Xc
Detach the specified
.Ar filesystem
from the user namespace identified by
.Ar nsfile .
.El
.Sh EXAMPLES
.Ss Example 1 : No Delegating a Dataset to a User Namespace
The following example delegates the
.Ar tank/users
dataset to a user namespace identified by user namespace file
.Pa /proc/1234/ns/user .
.Dl # Nm zfs Cm zone Ar /proc/1234/ns/user Ar tank/users
.
.Sh SEE ALSO
.Xr zfsprops 7 ,
.Xr zfs-allow 8
.Pp
For rootless container use cases where the namespace is ephemeral,
consider using the
.Sy zoned_uid
property instead, which delegates to all namespaces owned by a UID
rather than requiring attachment to a specific namespace file.
The
.Sy zoned_uid
property uses a three-layer additive authorization model
.Pq UID match, dsl_deleg grants, capability tiers
described in
.Xr zfsprops 7 .