After a lot of experimenting, as of August 2nd 2017 I was using the following filesystem heirarchy for my ZFS datasets during system setup when using Arch.
Dataset Structure
I'll use a few variables to represent different locations in the pool for datasets.
SYS_ROOT=vault/sys - The location of any systems on the pool.
DATA_ROOT=vault/data - System shared data.
Boot Environments
For boot environments I use the following configuration. SYSTEM_NAME can be anything, I use the hostname.
${SYS_ROOT}/${SYSTEM_NAME}/ROOT/${BOOT_ENV}
For example, my current boot environment which will be mounted to /:
vault/sys/chin/ROOT/default
In this configuration it makes it easy to dual boot multiple systems off of a single ZFS pool. To create a new system just add a new dataset under vault/sys, and set it up as normal. This should even work dual booting Linux and FreeBSD.
Datasets
While only a dataset for / really needs creating, I create quite a few. This lets me backup and snapshot only datasets I find important.
Setup datasets. Set all besides / legacy, or use zfs management. I like using legacy for multi system setups using a shared pool, and zfs for single install systems.
Boot environment Dataset
The boot environment will be mounted to / and store everything that doesnt have it's own mounted dataset.
Set /var, /var/lib and /usr to canmount=off meaning they're not mounted and are only there to create the directory structure. This will put their data in the boot environment dataset.' Their properties will be inherited.
The other datasets will be independent from the boot environment and will not change between boot environments.
System Datasets
I keep some datasets like /var/cache's' dataset seperate to avoid having to snapshot and backup their data. I also keep /var/log 's' dataset seperate so the logs are always available as well as the datasets for my containers and VMs.
zfs allow john create,mount,mountpoint,snapshot ${SYS_ROOT}/${SYSTEM_NAME}/home/john
Checking permissions shows john's permissions.
zfs allow ${SYS_ROOT}/${SYSTEM_NAME}/home/john
---- Permissions on vault/sys/chin/home/john -------------------------
Local+Descendent permissions:
user john create
[root@chin ~]# zfs allow john snapshot ${SYS_ROOT}/${SYSTEM_NAME}/home/john
[root@chin ~]# zfs allow ${SYS_ROOT}/${SYSTEM_NAME}/home/john
---- Permissions on vault/sys/chin/home/john -------------------------
Local+Descendent permissions:
user john create,snapshot
Available options:
NAME TYPE NOTES
allow subcommand Must also have the permission that is
being allowed
clone subcommand Must also have the 'create' ability and
'mount'
ability in the origin file system
create subcommand Must also have the 'mount' ability
destroy subcommand Must also have the 'mount' ability
hold subcommand Allows adding a user hold to a snapshot
mount subcommand Allows mount/umount of ZFS datasets
promote subcommand Must also have the 'mount' and 'promote'
ability in the origin file system
receive subcommand Must also have the 'mount' and 'create'
ability
release subcommand Allows releasing a user hold which
might destroy the snapshot
rename subcommand Must also have the 'mount' and 'create'
ability in the new parent
rollback subcommand
send subcommand
share subcommand Allows sharing file systems over NFS or
SMB protocols
snapshot subcommand
groupquota other Allows accessing any groupquota@...
property
groupused other Allows reading any groupused@... property
userprop other Allows changing any user property
userquota other Allows accessing any userquota@...
property
userused other Allows reading any userused@... property
aclinherit property
aclmode property
atime property
canmount property
casesensitivity property
checksum property
compression property
copies property
dedup property
devices property
exec property
logbias property
mlslabel property
mountpoint property
nbmand property
normalization property
primarycache property
quota property
readonly property
recordsize property
refquota property
refreservation property
reservation property
secondarycache property
setuid property
shareiscsi property
sharenfs property
sharesmb property
snapdir property
utf8only property
version property
volblocksize property
volsize property
vscan property
xattr property
zoned property
Data Datasets
I'll be mounting these under ${HOME}. They exist outside the different systems and are shared between them.
As of ZFS delegation using zfs allow works on linux. I delegate all datasets under ${SYS_ROOT}/${SYSTEM_NAME}/home/john to my user 'john' giving the abiity to snapshot and create datasets.