How to Use the Ubuntu chroot Command to Create an Isolated Guest Environment

Before the widespread adoption of modern container technologies like Docker and LXC, system administrators relied on the chroot (change root) command to create isolated environments. A chroot jail changes the apparent root directory for the current running process and its children. A program running inside a chroot jail cannot access files or commands outside that designated directory tree. While not a true security boundary on its own, it remains an incredibly useful tool for testing software, building packages safely, or rescuing a broken Ubuntu system.

Step 1: Understand the Goal

We are going to create a new directory (e.g., /var/my_jail). We will then use chroot to make the terminal believe that /var/my_jail is actually /. For this to work, the jail directory must contain all the basic Linux folders (/bin, /lib, /etc) and the specific executable binaries we want to run inside it.

Step 2: Create the Jail Directory Structure

First, create the root folder for your jail and the necessary subdirectories.

sudo mkdir -p /var/my_jail
cd /var/my_jail
sudo mkdir -p bin lib lib64 usr/bin usr/lib usr/lib64 etc

Step 3: Copy Necessary Binaries (The Hard Way vs. The Easy Way)

If you want to run the bash shell inside your jail, you must copy the bash executable from the host system into the jail’s /bin directory.

sudo cp /bin/bash /var/my_jail/bin/

However, bash relies on several dynamic libraries. You can find out which libraries it needs using the ldd command:

ldd /bin/bash

You would then have to manually copy every single .so file listed in the output into the corresponding /lib or /lib64 directories inside your jail. This is extremely tedious.

Step 4: The Easy Way (Using debootstrap)

Instead of copying binaries manually, Ubuntu provides the debootstrap tool. This tool downloads and installs a complete, minimal Ubuntu base system directly into your chosen directory.

1. Install the tool:
   sudo apt update && sudo apt install debootstrap
2. Run debootstrap to install a minimal version of the latest Ubuntu release (e.g., Jammy Jellyfish) into your jail directory:
   sudo debootstrap jammy /var/my_jail http://archive.ubuntu.com/ubuntu/

This process will take a few minutes as it downloads and extracts the core packages.

Step 5: Mount System Filesystems (Optional but Recommended)

If you plan to do serious work inside the jail (like installing new software using apt), the jail needs access to the kernel’s virtual filesystems (/proc, /sys, and /dev). You can temporarily bind-mount these from the host system into the jail.

sudo mount --bind /dev /var/my_jail/dev
sudo mount --bind /proc /var/my_jail/proc
sudo mount --bind /sys /var/my_jail/sys

Step 6: Enter the Chroot Jail

Now, execute the chroot command, specifying the path to your jail directory, followed by the command you want to run (usually /bin/bash).

sudo chroot /var/my_jail /bin/bash

Your prompt will likely change to root@hostname:/#. You are now inside the isolated environment.

1. Type ls /. You will only see the files inside /var/my_jail.
2. Type pwd. It will report /, not /var/my_jail.
3. You can now safely compile untrusted code or test dangerous configurations. If you destroy the OS inside the jail, the host Ubuntu system remains perfectly safe.

To exit the jail and return to your normal host terminal, simply type exit.