2 ms·
pivot_root is supposed to switch the whole system to a new root. chroot applies to a process, but the underlying system keeps going with what it had.
by rantwasp 6y ago
pivot_root is supposed to switch the whole system to a new root. chroot applies to a process, but the underlying system keeps going with what it had.
- cyphar 6y agoThis is true (though it's scoped per mount namespace), but it isn't the primary security reason container runtimes use pivot_root().