2 ms·

This is true (though it's scoped per mount namespace), but it isn't the primary security reason container runtimes use pivot_root().