> you can even chroot into foreign CPU architectures, which is a handy thing to have when you mount your phone's eMMC

This sounds very interesting! What's the scenario where you'd do this? Would you be, for example, emulating an ARM processor with qemu on an x86 computer and chrooting into Android on an eMMC?

Indeed you can skip most of the unnecessary additional mount requirements with systemd-nspawn. If /dev/sde1 (your root partition) is mounted to /tmp/rescue just run:

systemd-nspawn --directory /tmp/rescue --boot -- --unit rescue.target

It should automatically find the boot partition and mount it as well.

Of course you don't need it, but if you're into docker images, docker or podman can be configured to use QEMU when running a container too.

System Rescue is what i use these days, but to be honest i can’t recall using it in the last couple of year. Virtualization and containers have taken over.

https://www.system-rescue.org/

Hetzner also chroots you into a recovery linux and mounts your drive for access. Same thing different scale.

There seems to be a fundamental mismatch between how sane people think about sandboxing, and how linux manages namespaces.

A linux-naive developer would expect to spawn a new process from a payload with access to nothing. It can't see other processes, it has a read only root with nothing in it, there are no network devices, no users, etc. Then they would expect to read documentation to learn how to add things to the sandbox. They want to pass in a directory, or a network interface, or some users. The effort goes into adding resources to the sandbox, not taking them away.

Instead there is this elaborate ceremony where the principal process basically spawns another version of itself endowed with all the same privileges and then gives them up, hopefully leaving itself with only the stuff it wants the sandboxed process to have. Make sure you don't forget to revoke anything.

Come to FreeBSD, we have just that - jails.

We kind of did but its all put in the context of containers. Check out the unshare command.

unshare --mount

Most examples you'll find put it in the context of containers, like https://www.redhat.com/en/blog/mount-namespaces

Apples and oranges.

Among many other things, Docker (and Podman etc) has

1. Images and OverlayFS

2. Networking

3. User namespace mappings

4. Resource management

---

If all you want is file system isolation, then docker (and postman, etc) is massive overkill chroot is correct.

Plan9 had a proper solution for this. New processes don't get access to any files by default - you have to explicitly mount directories for them, capability style.

Shame Plan9 blew its weirdness budget.

Pids and cgroups all the way down (also why the wise greybeards rejected docker)

As a number of comments have noted, there are a bunch of different axes that chroot could be 'better' on - e.g. security and sandboxing.

I wrote https://github.com/aidanhs/machroot (initially forked from bubble wrap) a while ago to lean into the pure "pretend I see another filesystem" aspect of chroot with additional conveniences (so no security focus). For example, it allows setting up overlay filesystems, allows mounting squashfs filesystems with an overlay on top...and because it uses a mount namespace, means you don't need to tear down the mount points - just exit the command and you're done.

The codebase is pretty small so I just tweaked it with whatever features I needed at the time, rather than try and make it a fully fledged tool.

(honestly you can probably replicate most of it with a shell script that invokes unshare and appropriate mount commands)

systemd-nspawn is probably what you want.

I built https://github.com/jrz/container-shell as a simple chroot on docker. I use it for both development and sandboxing.

Besides that I have a simple script that starts an ephemeral docker with debian-full + tools.

I also have some scripts that leverage macOS's 'sandbox-exec'

Isn't LXC more or less an unsupervised chroot in an isolated process?

Working on proot-docker, a bash script on top of skopeo and proot:

https://github.com/mtseet/proot-docker

We need more people to improve it!

How do you imagine a "better chroot" would differ from a Docker container? Seems to me like that's exactly what Docker is.

ironically docker never gave you true network isolation because there's no way to make it user friendly. plus the many exploits on the all powerful daemon.

but most professional world use systemd to bootstrap isolated processes nowadays, which is kinda if what you are hinting at. cgroups2 and namespaces are what you want.

We should get a better change root yes, and the LD_LIBRARY_PATH gets autoupdated with respect to the new root. A few flags here and there to set permissions of the child process and we're off too the races.

Oh wow, wow. That all sounded so intensely complex, incomprehensible. What we are going to need to do is build a program to handle all that, highly formalized. Let's make it so formalized it's one of those things like taxes or AWS where people can just make a living from understanding the beast. It can be like systemd meets multics meets java. have it's own various complicated commands, complicated file formats, and so on. The chroot() is only historically understood by everyone, so let's steal a page from the java playbook and just rename everything with our own terminology. The product will be so outstanding, wow, I call it "Shocker"

what would "better chroot" do?

Docker is not using chroot in any way. Escaping chroot is only a matter of calling chdir('..') and poof, you are out of the "sandbox"

Gentoo’s stage3 would like to say a word

Manjaro has the same, I'd assume inherited from arch and modified.

I just wish the script could figure out a BTRFS drive without me manually mounting volumes :(

I've actually used this to unbrick my laptop before. Very useful

Good idea!

That's pretty incredible, that it works from Windows too!

Now I'm just wondering if it would work from a Linux running in the browser, accessing the USB through WebUSB ;D

That’s still how most Linux OS installers install. They just do that for you.

It’s still used for recovery but recovery partitions have kinda gone out of fashion as the ability to consistently boot has gotten better. Additionally, thumb drives and net boot make the partition a little less necessary.

"Technique" is a term for "something you can do, among a million other things, if you know enough about X".

I don’t think pivot_root is necessary for something like this, but a new mount namespace will definitely help avoid creating a mess on accident

Came here to suggest this. pivot_root has the advantage that it can remount the existing root. It's essentially meant for going from an initramfs using linuxrc to boot to a full-on init in the other root filesystem. If things are horribly broken you could use a shell or some other process as init.

Interesting question and I don't know how you'd do that - maybe using some statically linked binaries for fdisk and mkfs. However, why would you ever want to do that? If you want to remove data from the disk, then just running a suitable "dd" command would wipe the disk. I can't think of any other use case that wouldn't subsequently involve booting from a live iso which would let you format the disk anyway.

It's definitely possible. nixos-anywhere [0] implements this in a neat package for NixOS specifically. I am relatively certain you could use the same script to boot into a different distribution, though the installation part itself would obviously need to be adapted.

[0] https://github.com/nix-community/nixos-anywhere

There is!

arch-chroot [1], despite its name pretty much does all the `mount -t proc` stuff the post says. It's also available on other distros like debian [2]. I have used it in the past to chroot into fedora as well.

[1] https://man.archlinux.org/man/arch-chroot.8 [2] https://packages.debian.org/arch-install-scripts

In addition to the other comments: If you are on NixOS, you can use nixos-enter [1].

[1] https://wiki.nixos.org/wiki/Change_root

sudo arch-chroot .

This is now my default tool setting up raspberry like computers.

In a computer lab I hung out in back in college...

We used rcp to keep passwords in sync. Add the account on the main machine, rcp the password file to the other machine. sudo rcp /etc/password other:/etc/passwd was muscle memory.

One day, someone was getting added to the groups file to be able to work in the server web project. sudo rcp /etc/group other:/etc/passwd

Ooops. Couldn't log in to fix it.

"Is anyone logged into the other machine?" (someone said yes). "Type while 1 sync" ... (ok) ... And we flipped the power switch and brought it up in single user mode (since the password file was invalid). Next, need to establish a minimal /etc/passwd ... emacs /etc/passwd (nope) vi /etc/passwd (nope - invalid terminal 300h not in termcap). "Uhm... cat > /etc/passwd ?" (possible, but a PITA when there is a typo in transcription)

I was a wizard on a lpmud. "I know ed".

And we got a minimal password file restored while reading the hashed values over (no way where we going to have root::0:0:... as the file even for a second) and then rcp'ed the proper /etc/passwd and /etc/group file over to the other machine.

https://www.gnu.org/fun/jokes/ed-msg.txt

This is usually right. In this particular case the issue was actually in /boot, which might not have been obvious just mounting the main partition.

Not really, but yes there's a lot of files or things that seem to be files. Try plan9 though.

"files" is clearly a misnomer, it should have been "objects".

Ha, that is funny. Void Linux desperately needs a better installer. (IMHO)

Which raises the question of why they need chroot if they have the VM.

Another semi-related but equally odd view: Docker is an operating system and containers are processes.

The difference between Docker and chroot, by the way, is that Docker does a bunch more system calls to ch the root of several other things that are not the filesystem. It also sets up things inside those roots for you by default, so your containers can access the internet, for example.

What does the use of 'retarded' actually bring to your comment? That's entirely unnecessary.