not sure if you figured it out, but you can either delegate the dataset to the zone with the dataset property, or use a loopback mount (which is what youre doing when using the fs property, i'm not sure if `type=zfs` is valid but i don't know) if you delegate it you have to do all the administration of the delegated dataset in the zone itself, which means doing load-key, creating child datasets

within the zone.

i imagine if you do a loopback mount of an encrypted dataset in a zone you probably need to unlock it on the host before you start the zone since else you're going to be writing to the mountpoint instead of the mounted dataset

also on an unrelated note, is there any criteria for what gets into omnios-extra? i'd be interested in making packages for scdoc and soju at some point, maybe some other things as well