This uses systemd-containers, but can fall back to using a chroot, which requires root. Usermode linux involves running a linux-kernel as just another piece of

This uses systemd-containers, but can fall back to using a chroot, which requires root. Usermode linux involves running a linux-kernel as just another piece of software under linux. By telling software to access the usermode linux, you can give it a different "view" of the system. That linux kernel process must communicate with the real-kernel, doing things like forwarding network traffic to the "real" kernels network devices. It introduces overhead. A chroot interrupts one system call (or set of system calls?), making any program you call think "/" is a different directory. It literally changes root. That being said, all it changes is where programs think the root dir is. If you have software in the chroot that runs as root, it actually runs as root on your entire system. It can do things like load custom kernel modules. It can't break out of the chroot, chroots aren't a security feature. Containers, like systemd-nspawn, use cgroups along with a more-aggressive chroot-like thing, that gives programs a different view of all system calls, not just calls to the filesystem. This means you can run software as "root" in a container without privilege escalation. Of course it doesn't need to be a full container. Firejail can use those same mechanisms to do things like isolate just your web browser. https://firejail.wordpress.com/ https://firejail.wordpress.com/