author here: Not exactly, you can technically overwrite a file with bind mounts, e.g. use nsjail --chroot / -R /dev/null:/etc/passwd -- /bin/sh -i This will

author here: Not exactly, you can technically overwrite a file with bind mounts, e.g. use nsjail --chroot / -R /dev/null:/etc/passwd -- /bin/sh -i This will make /etc/passwd empty, but nsjail doesn't rewrite syscalls. In order to do that, you'd have to use SECCOMP_RET_TRACE (TRACE(number) in kafel config lang), and then add some C code to nsjail which will use ptrace() to intercept and rewrite your syscall. It's possible, just not implemented, because it didn't seem like something that's required by users.