>At the end all of your jails end up on the same loopback interface, making it hard to firewall. I couldn't find a way to have one network interface per jail.

FreeBSD jails has quite a bit of history (developed in 1998) and made public in the year 2000. FreeBSD has had VNET for use with jails allowing you to add epair interfaces connected to a bridge, or add a physical interface or VLAN to a jail. This feature has been in FreeBSD since 8.0 (2009) and enabled by default since 2018. It also allows you to run PF in each jail.

Sadly many people a bitten by outdated forum and blog posts when it comes to jails.

I agree that firewalling jails with loopbacks is a pain, but most people don't do it that way anymore.

Also PF has always had atomic reloads.