--- a/docs/conf.py	Mon Dec 05 09:37:53 2022 +0100
+++ b/docs/conf.py	Mon Dec 05 16:01:54 2022 +0100
@@ -79,6 +79,7 @@
     ("man/man8/fjail-configure", "fjail-configure", "Basic configuration of jails", [author], 8),
     #("man/man8/fjail-copy", "fjail-copy", "Recursively copy ZFS datasets including all properties", [author], 8),
     #("man/man8/fjail-datasets", "fjail-datasets", "Create a new tree of ZFS datasets that will encompass a jail", [author], 8),
+    ("man/man8/fjail-freebsd-update", "fjail-freebsd-update", "A checked \"freebsd-update\"", [author], 8),
     ("man/man8/fjail-hostid", "fjail-hostid", "Generate a proposal for a new BSD Host UUID and ID", [author], 8),
     #("man/man8/fjail-mount", "fjail-mount", "Recursively mount a ZFS dataset and its children", [author], 8),
     #("man/man8/fjail-populate", "fjail-populate", "Populate a directory with content from a FreeBSD base.txz", [author], 8),

--- a/docs/man/index8.rst	Mon Dec 05 09:37:53 2022 +0100
+++ b/docs/man/index8.rst	Mon Dec 05 16:01:54 2022 +0100
@@ -12,6 +12,7 @@
    man8/bsmtp2dma
    man8/fjail
    man8/fjail-configure
+   man8/fjail-freebsd-update
    man8/fjail-hostid
    man8/fpkg
    man8/ftjail

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/docs/man/man8/fjail-freebsd-update.rst	Mon Dec 05 16:01:54 2022 +0100
@@ -0,0 +1,41 @@
+.. -*- coding: utf-8; indent-tabs-mode: nil; -*-
+
+fjail-freebsd-update
+====================
+
+Synopsis
+--------
+
+**fjail freebsd-update** [**-c** `currently-running`] `directory`
+
+
+Description
+-----------
+
+A checked :manpage:`freebsd-update(8)` for a system located or mounted
+at `directory`. A corresponding jail may or may not be running.
+
+.. program:: fjail freebsd-update
+
+.. option:: -c currently-running
+
+   Do not assume that the system at `directory` is currently running
+   the host's FreeBSD version but the version given in
+   `currently-running`.
+
+   This will also be checked by :manpage:`freebsd-version(1)` for
+   `directory`.
+
+
+Environment
+-----------
+
+All environment variables that affect :manpage:`freebsd-update` are
+effective also.
+
+
+See Also
+--------
+
+:manpage:`fjail(8)`, :manpage:`freebsd-update(8)`,
+:manpage:`freebsd-version(1)`

--- a/docs/man/man8/fjail.rst	Mon Dec 05 09:37:53 2022 +0100
+++ b/docs/man/man8/fjail.rst	Mon Dec 05 16:01:54 2022 +0100
@@ -46,6 +46,11 @@
 
     Create a new tree of ZFS datasets that will encompass a jail
 
+:manpage:`fjail-freebsd-update(8)`
+
+    Do a :manpage:`freebsd-update(8)` with some additional
+    compatibility checks
+
 :manpage:`fjail-hostid(8)`
 
     Generate a proposal for a new BSD host UUID and ID

--- a/pkg-plist	Mon Dec 05 09:37:53 2022 +0100
+++ b/pkg-plist	Mon Dec 05 16:01:54 2022 +0100
@@ -10,6 +10,7 @@
 %%DOCS%%man/man8/bsmtp2dma.8.gz
 %%DOCS%%man/man8/fjail.8.gz
 %%DOCS%%man/man8/fjail-configure.8.gz
+%%DOCS%%man/man8/fjail-freebsd-update.8.gz
 %%DOCS%%man/man8/fjail-hostid.8.gz
 %%DOCS%%man/man8/fpkg.8.gz
 %%DOCS%%man/man8/ftjail.8.gz

--- a/sbin/fjail	Mon Dec 05 09:37:53 2022 +0100
+++ b/sbin/fjail	Mon Dec 05 16:01:54 2022 +0100
@@ -79,6 +79,11 @@
     -r        Copy the datasets with the -Lec options (aka "raw")
     -u        Do not automatically mount received datasets
 
+  freebsd-update [OPTIONS] DIRECTORY OPERATIONS...
+
+    -c CURRENTLY-RUNNING   Assume the systen given in CURRENTLY-RUNNING is
+                           installed/running at given DIRECTORY
+
 ENVIRONMENT:
 
   All environment variables that affect "zfs" are effective also.
@@ -142,6 +147,8 @@
 #:
 #: Args:
 #:   $1: the location where to check for
+#:   $2: an optional reference FreeBSD version to compare to (default is the
+#:       version of the host)
 #:
 #: Returns:
 #:   0 if the userland versions match, 1 otherwise
@@ -150,15 +157,18 @@
 #:   1 on fatal errors (e.g. /bin/freebsd-version not found or errors)
 #:
 _has_same_userland_version() {
-    local directory
+    local directory ref_version
 
-    local _host_version _directory_version
+    local _directory_version
 
     directory="$1"
+    ref_version="${2:-}"
 
-    _host_version=$(/bin/freebsd-version -u) || exit 1
+    if [ -z "${ref_version}" ]; then
+        ref_version=$(/bin/freebsd-version -u) || exit 1
+    fi
     _directory_version=$(chroot "${directory}" /bin/freebsd-version -u) || exit 1
-    if [ "${_host_version%%-*}" = "${_directory_version%%-*}" ]; then
+    if [ "${ref_version%%-*}" = "${_directory_version%%-*}" ]; then
         return 0
     fi
     return 1
@@ -599,6 +609,49 @@
 }
 
 
+#:
+#: Implement the "freebsd-update" command
+#:
+command_freebsd_update() {
+    local directory operations
+
+    local opt_currently_running
+
+    opt_currently_running=""
+    while getopts "c:" _opt ; do
+        case ${_opt} in
+            c)
+                opt_currently_running="$OPTARG"
+                ;;
+            \?|:)
+                return 2;
+                ;;
+        esac
+    done
+    shift $((OPTIND-1))
+    OPTIND=1
+
+    directory="${1-}"
+
+    [ -z "${directory}" ] && { echo "ERROR: no directory given" 1>&2; return 2; }
+    [ -d "${directory}" ] || { echo "ERROR: directory \`${directory}' does not exist" 1>&2; return 1; }
+
+    shift
+    operations="$@"
+
+    if _has_same_userland_version "${directory}" "${opt_currently_running}" ; then
+        if [ -n "${opt_currently_running}" ]; then
+            freebsd-update -b "${directory}" --currently-running "${opt_currently_running}" ${operations}
+        else
+            freebsd-update -b "${directory}" ${operations}
+        fi
+    else
+        echo "ERROR: Userland version mismatch" 1>&2
+        return 1
+    fi
+}
+
+
 #
 # Global option handling
 #
@@ -659,6 +712,9 @@
     copy)
         command_copy "$@"
         ;;
+    freebsd-update)
+        command_freebsd_update "$@"
+        ;;
     *)
         echo "ERROR: unknown command \`${command}'" >&2
         exit 2