How to Use Ubuntu Server chroot to Create Isolated Environments

In modern Linux administration, “containers” like Docker are the industry standard for isolating applications. However, long before Docker existed, system administrators used a fundamental Unix tool to achieve a basic level of isolation: chroot (change root). By using chroot, you can trick a running process into believing that a specific sub-folder on your hard drive (e.g., /var/jail/) is actually the absolute root (/) of the entire file system. This prevents the process—and any user running it—from seeing or accessing anything outside of that restricted directory.

Why Use chroot Today?

While Docker is better for complex applications, chroot is still incredibly useful for:

1. Securing FTP or SFTP users: Forcing a client to only see their specific home directory.
2. System Recovery: Booting from a Live CD, mounting a broken system’s hard drive, and “chrooting” into it to repair the GRUB bootloader or reset a root password.
3. Lightweight Testing: Quickly running untrusted, statically compiled binaries without the overhead of spinning up a full container.

Step 1: Create the New Root Directory

First, we need to create the directory that will act as the fake “root” for our isolated environment.

sudo mkdir -p /var/myjail

Step 2: Understand the Dependency Problem

If you simply run sudo chroot /var/myjail /bin/bash right now, it will instantly fail with a “no such file or directory” error. Why? Because the fake root is completely empty. The /bin/bash executable does not exist inside /var/myjail. Furthermore, even if you copy the bash executable into the jail, it still won’t run because it relies on shared C libraries located in /lib and /lib64.

To make a chroot jail work, you must manually copy the executable and all of its required libraries into the jail.

Step 3: Copy the Executable and Libraries

First, create the necessary folder structure inside the jail to mirror the real system.

sudo mkdir -p /var/myjail/{bin,lib,lib64}

Next, copy the bash executable:

sudo cp /bin/bash /var/myjail/bin/

Now, you must find out exactly which libraries bash needs to run. Use the ldd (List Dynamic Dependencies) command:

ldd /bin/bash

The output will list several .so files and their absolute paths (e.g., /lib/x86_64-linux-gnu/libc.so.6). You must carefully copy every single one of those files into the corresponding directory inside your jail.

sudo cp /lib/x86_64-linux-gnu/libc.so.6 /var/myjail/lib/

(You must repeat the cp command for every library listed by ldd).

Step 4: Enter the Jail

Once bash and all its libraries are in place, you can finally execute the change root command.

sudo chroot /var/myjail /bin/bash

Your prompt will change. You are now running a shell inside the isolated directory. If you type cd / and then ls, you will only see the bin, lib, and lib64 folders you created. You cannot navigate “up” to see the real server’s /etc or /home directories because, as far as this bash process is concerned, they do not exist.

Step 5: The Limitations of chroot

It is crucial to understand that chroot is not a perfect security boundary. While it restricts the file system, it does not restrict the CPU, memory, or network stack. Furthermore, if a process running inside the jail has full root privileges, there are several known exploits it can use to “break out” of the jail and access the real host system. For true, secure isolation, you must combine chroot with kernel namespaces and cgroups—which is exactly what modern container runtimes like Docker do under the hood.