Jails are nice but it has always seemed like a system where you don’t need another copy of userland would be better (eg sandboxing). It’s wasteful and you might forget to apply security patches.
My unbound dns server, for instance, has something like 24 total files in it. The reason it has so many is because I run two different jails from it - my unbound jail and my nsd jail share the same directory/mountpoint.
Which is to say, I run two different jail commands, that start two different jails with different IPs and startup commands, but they both point to the same directory/mountpoint.
Updates consist of replacing a few binary executables.
Not everything will fit into that model, but when it does, it is fantastic.
jail -c path=/ ip4.addr=disable ip6=inherit command=/bin/csh
So you can use jails to sandbox applications. You can also mount all paths are read-only and only the paths required for the application as read/write. jails can be very handy for all kinds of operations around that, there is no requirement that you provide the jail with a copy of the user land again, although that is the easiest way to run jails.