NAME

       linux-user-chroot - safely allow normal users to chroot

SYNOPSIS

       linux-user-chroot  [--unshare-ipc]  [--unshare-pid]  [--unshare-net] [--mount-proc DIR] [--mount-readonly
       DIR] [--mount-bind SOURCE DEST] [--chdir DIR] ROOTDIR PROGRAM ARGS...

DESCRIPTION

       linux-user-chroot is a tool meant for building software in a clean environment.  The user needs to create
       a directory tree with the build dependencies needed, and only those, and then linux-user-chroot runs  the
       actual  build  commands  such that the commands only see the directory tree.  This is useful for ensuring
       the build gets the right version of its build dependencies, for example.

       linux-user-chroot works similary to chroot(8), but does not require the caller to have  root  privileges.
       It  uses Linux containers to restrict the chroot to make this safe.  The command run inside the chroot is
       run as the calling user, not as root.

       linux-user-chroot executes a command, and sets the root  directory  for  the  command  to  the  directory
       specified  by  the  user  (ROOTDIR).   Additionally,  it  creates  a  "nosuid"  bind  mount over the root
       filesystem, to prevent the build from gaining privileges using setuid binaries.  The command can  further
       be  restricted  from  accessing  the  network,  and  it  can  be  set up with new process ID and SysV IPC
       namespaces.

OPTIONS

       --unshare-ipc
              Create a new SysV IPC namespace for the command.

       --unshare-pid
              Create a new process ID (PID) namespace for the command.  This prevents the  command  from  seeing
              any other processes in the system, except itself and the processes it itself creates.

       --unshare-net
              Create  a  new,  empty  networking  stack.   This  prevents the command from using any networking,
              including loopback.

       --mount-proc DIR
              Mount the proc filesystem at DIR.

       --mount-readonly DIR
              Make DIR be read-only for the command.

       --mount-bind SOURCE DEST
              Add a bind mount while the command is executing.

       --chdir DIR
              After setting the new root directory for the command, change the current working directory  to  be
              DIR.

EXIT STATUS

       The  exit  status is the exit status of the executed command, or 1 if linux-user-chroot failed to execute
       the command.

EXAMPLE

       To build software in the real system, but without networking:

              linux-user-chroot --unshare-net --chdir "$(pwd)"
              make clean all check

SEE ALSO

       chroot(8).

                                                                                            LINUX-USER-CHROOT(8)