An additional question: how come "sade" and "sysinstall" which are run
inside the jail can see (and I can only assume they can also operate
on and damage) the real underlying disks of the host?
Disks (as well as others you have in your host's /dev) aren't visible
inside jails.
Well, somehow they are on my system.
I guess I should've also clarified that the jail was installed using
ezjail and not completely manually
From /usr/local/etc/ezjail/semipublic
export jail_semipublic_devfs_enable="YES"
export jail_semipublic_devfs_ruleset="devfsrules_jail"