5 ms·
It creates a new mount namespace, and bind-mounts your ENTIRE filesystem into it, before chrooting, so that it can optionally remount / as ro to prevent applica
by notamy 4y ago
It creates a new mount namespace, and bind-mounts your ENTIRE filesystem into it, before chrooting, so that it can optionally remount / as ro to prevent applications from writing outside of the desired directories. The namespace is to allow doing the bind mounts in the first place.