Linux Tips

Chroot in Linux: 3 Powerful Ways to Isolate Processes

- by John Britto - Leave a Comment - 1 min read
Quick Linux Tip #112:

Question: I need to run an untrusted binary without exposing my whole system. How?

Try: sudo mkdir -p /jail/{bin,lib,lib64}

Info: chroot restricts a process to a specified root directory, preventing it from accessing the rest of the filesystem.

Examples:

  • $ ldd /bin/bash  # List all required shared libraries for a binary
  • $ sudo systemd-nspawn -D /jail  # Modern container-based isolation alternative
  • $ sudo chroot /mnt/recovery /bin/bash  # Chroot into a rescue environment for system repair

Note: chroot is not a secure sandbox boundary—root users can easily escape it. For true process isolation, use containers (Docker, LXC) or kernel namespaces (unshare).




LinuxTeck.com 
linuxteck:~$ sudo mkdir -p /jail/{bin,lib,lib64}

linuxteck:~$ sudo cp /bin/bash /bin/ls /jail/bin/

linuxteck:~$ ldd /bin/bash | awk '{print $3}' | grep -v '^$' | xargs -I {} sudo cp --parents {} /jail/

linuxteck:~$ sudo cp --parents /lib64/ld-linux-x86-64.so.2 /jail/

linuxteck:~$ sudo chroot /jail /bin/bash
bash-5.1# ls /
bin lib lib64
bash-5.1# cat /etc/passwd
cat: /etc/passwd: No such file or directory
bash-5.1# exit
exit
linuxteck:~$

PREVIOUS ARTICLE Quick Linux Tip #111: Hardlinks in Linux: 3 Commands to Find Duplicate Files NEXT ARTICLE Quick Linux Tip #113: Time -v in Linux: 5 Metrics to Diagnose Slow Scripts
About John Britto

John Britto Founder & Chief-Editor @LinuxTeck. A Computer Geek and Linux Intellectual having more than 20+ years of experience in Linux and Open Source technologies.

View all posts by John Britto →

Leave a Reply

Your email address will not be published.