LINUX-USER-CHROOT(8)

💖 LINUX-USER-CHROOT(8) 💖

okay bestie, welcome to linux-user-chroot — straight out of the System Manager's Manual, section 8, and she's literally the moment.

---

✨ NAME ✨

linux-user-chroot — safely allow normal users to chroot 🫶

---

🌸 SYNOPSIS 🌸

linux-user-chroot [--unshare-ipc] [--unshare-pid] [--unshare-net]
[--seccomp-profile-version] [--mount-proc DIR] [--mount-readonly DIR]
[--mount-bind SOURCE DEST] [--chdir DIR] ROOTDIR PROGRAM ARGS...

---

🦋 DESCRIPTION 🦋

so linux-user-chroot is a setuid program that lets non-root users safely use some Linux kernel container features. no cap. it's primarily intended for use by build systems, which is such a mood honestly.

here's the vibe: you (the user) create a directory tree that has the build dependencies you need — and only those — and then linux-user-chroot runs the actual build commands in a way where the commands only see that directory tree. it's giving "controlled environment" and it's genuinely useful for making sure your build gets the right version of its build dependencies, for example. 💅

linux-user-chroot works similary to chroot(8), but — and this is the iconic part — it does not require the caller to have root privileges. it uses Linux containers to restrict the chroot so this is actually safe. and the command run inside the chroot runs as the calling user, not as root. main character energy but humble about it.

linux-user-chroot executes a command, and sets the root directory for that command to the directory you specified (ROOTDIR). on top of that, it creates a "nosuid" bind mount over the root filesystem, so the build can't go gaining privileges with setuid binaries. rude of them to try, honestly. 🙈

and the command can be further restricted — you can cut it off from the network entirely, and you can set it up with new process ID and SysV IPC namespaces. obsessed.

---

💅 OPTIONS 💅

• --unshare-ipc — creates a brand new SysV IPC namespace for the command. fresh namespace, who dis.
• --unshare-pid — creates a new process ID (PID) namespace for the command. this means the command literally cannot see any other processes on the system, except itself and the processes it creates itself. so peaceful.
• --unshare-net — creates a new, empty networking stack. the command can't use any networking at all, including loopback. offline era, periodt.
• --mount-proc DIR — mounts the proc filesystem at DIR.
• --mount-devapi DIR — mounts just the API devices (null, full, urandom etc) at DIR.
• --mount-readonly DIR — makes DIR read-only for the command. look but don't touch.
• --mount-bind SOURCE DEST — adds a bind mount while the command is executing.
• --chdir DIR — after setting the new root directory for the command, changes the current working directory to be DIR.
• --seccomp-profile-version VERSION — okay so seccomp is a tool to restrict the system calls applications can make. since linux-user-chroot is designed for build systems, we don't need to expose the entire kernel system call interface. currently a number of

this argument is an integer, where -1 means "no seccomp", and "0" enables the first profile version. this is an opt-in system to any future versions. ✨

---

💀 EXIT STATUS 💀

the exit status is the exit status of the executed command, or 1 if linux-user-chroot failed to execute the command.

ngl bestie, if you see that 1, something went sideways before your program even got to run. 😭

---

🎀 EXAMPLE 🎀

to build software in the real system, but without networking:

linux-user-chroot --unshare-net --chdir "$(pwd)"
make clean all check

---

👑 SEE ALSO 👑

chroot(8).

---

okay that's the whole page, bestie! this one came to you from the System Manager's Manual — it's LINUX-USER-CHROOT(8), and if you need the version and date, they're right there on the page itself, iykyk. go build something cute and sandboxed. 🧚💜