host level daemons (e.g local_unbound) cannot bind to specific IPs or interfaces of jails before these are started. They can be bound to for example lo0 -- but if this is done before the jail starts - they won't pick up that jail yet.

My current solution is as per https://www.bsdstore.ru/en/13.0.x/wf_jconfig_ssi.html#execscript; where for each jail I have a workdir/jails-system/*/master_poststart.d/script that does simply

   #!/bin/sh
   service local_unbound restart

to make sure DNS works in the jail. It would be nice if there was a way to do workdir/jails-system/_BASE/master_poststart.d/script or something - which would run for all jails as not to copy the same script to lots of places.

Or is there a clever way to always run a script post any jail start ?