Chroot - Revision history

John3-16: Added paragraph encouraging the creation and maintenance of a repair disk beforehand for chrooting and as a fallback system

2025-12-15T17:54:57Z

Added paragraph encouraging the creation and maintenance of a repair disk beforehand for chrooting and as a fallback system

← Older revision		Revision as of 17:54, 15 December 2025
Line 14:		Line 14:
	* Can run legacy software or other software whose supporting libraries or data files can't be installed in the host system.		* Can run legacy software or other software whose supporting libraries or data files can't be installed in the host system.
	* Open file descriptors (for files, pipelines and network connections) can be "carried into" the chroot by running programs, making it unnecessary for those programs' working files to be visible inside the chroot directory. This can help separate privileges or design sandboxes. Note that chroot is not a secure way to contain a hostile process with root privileges. See Wikipedia's [https://en.wikipedia.org/wiki/Chroot#Limitations discussion of some of chroot's limits].		* Open file descriptors (for files, pipelines and network connections) can be "carried into" the chroot by running programs, making it unnecessary for those programs' working files to be visible inside the chroot directory. This can help separate privileges or design sandboxes. Note that chroot is not a secure way to contain a hostile process with root privileges. See Wikipedia's [https://en.wikipedia.org/wiki/Chroot#Limitations discussion of some of chroot's limits].

			As a preemptive measure, therefore, in order to execute these chroot actions and as a fallback workstation, it would be wise to create and maintain the [[Installation#Post-Installation\|Rescue CD/repair disk]] beforehand.

	Scripts for installing Alpine Linux that use chroot:		Scripts for installing Alpine Linux that use chroot:

Prabuanand: reworded, changed heading added wikilinks

2025-06-16T08:54:42Z

reworded, changed heading added wikilinks

← Older revision		Revision as of 08:54, 16 June 2025
Line 20:		Line 20:
	* [https://github.com/jirutka/alpine-make-rootfs alpine-make-rootfs]		* [https://github.com/jirutka/alpine-make-rootfs alpine-make-rootfs]

			== Prepare chroot ==
	== ~~Preparation~~ ==

	~~<ul>~~

	<li>All the steps in this guide will have to be performed as root user.		<li>All the steps in this guide will have to be performed as root user.
Line 51:		Line 48:
	</ul>		</ul>

	== ~~Performing the~~ chroot ==		== Enter chroot==

	The most reliable way to chroot is to use the following script:		The most reliable way to chroot is to use the following script: {{Cat\|start-chroot\|{{:Chroot/start-chroot}}}}

	~~{{Cat\|/root/start-chroot\|{{:Chroot/start-chroot}}}}~~		Copy that script to some location on your system, such as {{Path\|/root/start-chroot}}, run <code>chmod +x</code> on it, and then invoke it as: {{Cmd\|/root/start-chroot $CHROOT}}


	Copy that script to some location on your system, such as {{Path\|/root/start-chroot}}, run <code>chmod +x</code> on it, and then invoke it as:
	{{Cmd\|/root/start-chroot $CHROOT}}

	{{Todo\|Comment on Environment variables, extra arguments to start-chroot}}		{{Todo\|Comment on Environment variables, extra arguments to start-chroot}}

	It is certainly possible to perform a chroot by hand, without using this script. For some purposes, you can get away with a simpler procedure than the script follows. But it's hard to catalogue in advance when taking shortcuts will get you in trouble, so it's best to just get in the habit of using this script (or doing the same things it does). As you read around in various wikis (perhaps including this one), you will encounter a variety of instructions for how to chroot by hand. These instructions often differ in small details from each other and are usually not as thorough as the above script.		It is certainly possible to perform a chroot by hand, without using this script. For some purposes, you can get away with a simpler procedure than the script follows. But it's hard to catalogue in advance when taking shortcuts will get you in trouble, so it's best to just get in the habit of using this script (or doing the same things it does). As you read around in various wikis (perhaps including this one), you will encounter a variety of instructions for how to chroot by hand. These instructions often differ in small details from each other and are usually not as thorough as the above script.


	~~=== Troubleshooting ===~~

	~~If you see the error:~~

	* <code>chroot: cannot run command '/bin/sh': Exec format error</code>, it is likely that the architectures of the host environment and the chroot environment do not match. For example, you booted with a 32bit Live CD and are trying to chroot into an x86_64 system.
	* <code>chroot: '/bin/sh': Permission denied</code>, try remounting the system with exec permissions: <code>mount -o remount,exec $CHROOT</code>

	== Inside the chroot ==		== Inside the chroot ==
Line 92:		Line 77:
	If you'll be doing anything with GRUB, you should first make sure that sure your {{Path\|/etc/mtab}} file is up-to-date:		If you'll be doing anything with GRUB, you should first make sure that sure your {{Path\|/etc/mtab}} file is up-to-date:
	{{Cmd\|grep -v rootfs /proc/mounts > /etc/mtab}}		{{Cmd\|grep -v rootfs /proc/mounts > /etc/mtab}}



	=== Run graphical applications from the chroot ===		=== Run graphical applications from the chroot ===
			{{Seealso\|Software_management#Bubblewrap + Chroot}}
			If you have an X server running on your outside/host system, you can start graphical applications from inside the chroot. To allow the chroot environment to connect to the X server, you have to do this in the host system (either before chrooting, or in a terminal other than the one you performed the chroot in):{{Cmd\|xhost +local:}}

	If you have an X server running on your outside/host system, you can start graphical applications from inside the chroot. To allow the chroot environment to connect to the X server, you have to do this in the host system (either before chrooting, or in a terminal other than the one you performed the chroot in):		Then, to direct applications from the chroot to the X server, set the <code>DISPLAY</code> environment variable inside the chroot to match its value in the host environment (for the user who owns the X server). So for example, inside the chroot you might say:{{Cmd\|export DISPLAY{{=}}:0}}
	~~{{Cmd\|xhost +local:}}~~

	Then, to direct applications from the chroot to the X server, set the <code>DISPLAY</code> environment variable inside the chroot to match its value in the host environment (for the user who owns the X server). So for example, inside the chroot you might say:
	{{Cmd\|export DISPLAY{{=}}:0}}

	== Cleaning up ==		== Cleaning up ==

	When you're finished, ensure that all running programs have stopped. Then exit the chroot:		When you're finished, ensure that all running programs have stopped. Then exit the chroot:{{Cmd\|exit}}
	{{Cmd\|exit}}

	If you started the chroot using the {{Path\|start-chroot}} script, it will take care of umounting {{Path\|/dev}}, {{Path\|/proc}}, {{Path\|/sys}}, {{Path\|/tmp}}, and so on. Else you should do this by hand. In any case, you should umount any partitions like {{Path\|/boot}} that you mounted yourself, and then umount the system partition at <code>$CHROOT</code> if appropriate.		If you started the chroot using the {{Path\|start-chroot}} script, it will take care of umounting {{Path\|/dev}}, {{Path\|/proc}}, {{Path\|/sys}}, {{Path\|/tmp}}, and so on. Else you should do this by hand. In any case, you should umount any partitions like {{Path\|/boot}} that you mounted yourself, and then umount the system partition at <code>$CHROOT</code> if appropriate.
Line 117:		Line 97:
	In the latter case, simply unmount the offending mountpoint first. To get a reminder of all the current mountpoints, run <code>mount</code> with no parameters.		In the latter case, simply unmount the offending mountpoint first. To get a reminder of all the current mountpoints, run <code>mount</code> with no parameters.

			== Troubleshooting ==

	~~== Other Resources ==~~		If you see the error:
			* <code>chroot: cannot run command '/bin/sh': Exec format error</code>, it is likely that the architectures of the host environment and the chroot environment do not match. For example, you booted with a 32bit Live CD and are trying to chroot into an x86_64 system.
			* <code>chroot: '/bin/sh': Permission denied</code>, try remounting the system with exec permissions: <code>mount -o remount,exec $CHROOT</code>

			== See also ==
			* [[Alpine Linux in a chroot]]
	* [https://superuser.com/questions/111152 What's the proper way to prepare chroot to recover a broken Linux installation?]		* [https://superuser.com/questions/111152 What's the proper way to prepare chroot to recover a broken Linux installation?]
	* [https://wiki.archlinux.org/title/Chroot ArchLinux wiki on "Change Root"]		* [https://wiki.archlinux.org/title/Chroot ArchLinux wiki on "Change Root"]

Zcrayfish: The directions on the page seem to work...

2024-01-13T18:09:02Z

The directions on the page seem to work...

← Older revision		Revision as of 18:09, 13 January 2024
Line 1:		Line 1:
	~~{{Draft\|grsec info needs to be removed, we don't use that any more in Alpine Linux.}}~~

	"Changing root" or "chrooting" is a method for zooming in on part of your filesystem, so that, for example, {{Path\|/path}} will refer to what was formerly accessible at {{Path\|/mnt/path}}. The "root" in the expression "chroot" refers to the root filesystem {{Path\|/}}, not to the root user. (Though typically you will need root user privileges in order to chroot.)		"Changing root" or "chrooting" is a method for zooming in on part of your filesystem, so that, for example, {{Path\|/path}} will refer to what was formerly accessible at {{Path\|/mnt/path}}. The "root" in the expression "chroot" refers to the root filesystem {{Path\|/}}, not to the root user. (Though typically you will need root user privileges in order to chroot.)

Zcrayfish: /* Run graphical applications from the chroot */ remove grsec stuff.

2024-01-13T18:08:33Z

Run graphical applications from the chroot: remove grsec stuff.

← Older revision		Revision as of 18:08, 13 January 2024
Line 104:		Line 104:
	Then, to direct applications from the chroot to the X server, set the <code>DISPLAY</code> environment variable inside the chroot to match its value in the host environment (for the user who owns the X server). So for example, inside the chroot you might say:		Then, to direct applications from the chroot to the X server, set the <code>DISPLAY</code> environment variable inside the chroot to match its value in the host environment (for the user who owns the X server). So for example, inside the chroot you might say:
	{{Cmd\|export DISPLAY{{=}}:0}}		{{Cmd\|export DISPLAY{{=}}:0}}

	~~If you're running a Grsec enabled kernel and the graphical application fails to connect, you may need to allow abstract unix domain sockets outside of chroot.~~

	~~Run the following command on the host as root user:~~
	~~{{Cmd\|sysctl -w kernel.grsecurity.chroot_deny_unix{{=}}0}}~~

	== Cleaning up ==		== Cleaning up ==

Zcrayfish: /* Performing the chroot */ Moved start-chroot script to its own plain-text article and included it.

2024-01-13T18:07:56Z

Performing the chroot: Moved start-chroot script to its own plain-text article and included it.

← Older revision		Revision as of 18:07, 13 January 2024
Line 57:		Line 57:
	The most reliable way to chroot is to use the following script:		The most reliable way to chroot is to use the following script:

	{{Cat\|/root/start-chroot\|~~<nowiki>~~		{{Cat\|/root/start-chroot\|{{:Chroot/start-chroot}}}}
	~~#!/bin/sh -e~~

	~~if [ 0 -ne `id -u` ]; then~~
	~~echo "This script needs root access" >&2~~
	~~exit 1~~
	fi

	~~if ! [ -d "$1" ] \|\| [ x-h = x"$" ] \|\| [ x--help = x"$" ]; then~~
	~~echo "Usage: $~~{~~0##*/} <chroot_directory>" >&2~~
	~~exit 1~~
	fi

	~~if [ x1 = x`sysctl -ne kernel.grsecurity.chroot_deny_chmod` ]; then~~
	~~echo "Warning~~: ~~can't suid~~/~~sgid inside chroot" >&2~~
	fi
	~~if [ x1 = x`sysctl -ne kernel.grsecurity.chroot_deny_mknod` ]; then~~
	~~echo "Warning: can't mknod inside chroot" >&2~~
	fi
	~~if [ x1 = x`sysctl~~ -~~ne kernel.grsecurity.chroot_deny_mount` ]; then~~
	~~echo "Warning: can't mount inside~~ chroot~~" >&2~~
	fi
	~~if [ x1 = x`sysctl -ne kernel.grsecurity.chroot_deny_chroot` ]; then~~
	~~echo "Warning: can't chroot inside chroot" >&2~~
	fi

	~~cd "$1"~~
	~~if ! [ -d ./etc ]; then~~
	~~echo "No etc directory inside $1" >&2~~
	~~exit 1~~
	fi
	~~shift~~

	~~MOUNTED=~~
	~~umount_all() {~~
	~~case $MOUNTED in~~
	~~shm\ *) if [ -L ./dev/shm ]; then~~
	~~umount ./`readlink ./dev/shm`~~
	~~else~~
	~~umount ./dev/shm~~
	fi
	~~MOUNTED=${MOUNTED#shm~~ };;
	~~esac~~
	~~case $MOUNTED in~~
	~~run\ *) umount ./run~~
	~~MOUNTED=${MOUNTED#run };;~~
	~~esac~~
	~~case $MOUNTED in~~
	~~tmp\ *) umount ./tmp~~
	~~MOUNTED=${MOUNTED#tmp };;~~
	~~esac~~
	~~case $MOUNTED in~~
	~~proc\ *) umount ./proc~~
	~~MOUNTED=${MOUNTED#proc };;~~
	~~esac~~
	~~case $MOUNTED in~~
	~~sys\ *) umount ./sys~~
	~~MOUNTED=${MOUNTED#sys };;~~
	~~esac~~
	~~case $MOUNTED in~~
	~~pts\ *) umount ./dev/pts~~
	~~MOUNTED=${MOUNTED#pts };;~~
	~~esac~~
	~~case $MOUNTED in~~
	~~dev\ *) umount ./dev~~
	~~MOUNTED=${MOUNTED#dev };;~~
	~~esac~~
	}
	~~trap 'umount_all' EXIT~~

	~~#mkdir -p ./etc ./dev/pts ./sys ./proc ./tmp ./run ./boot ./root~~

	~~cp -iL /etc/resolv.conf ./etc/ \|\| true # if ^C, will cancel script~~

	~~mount --bind /dev ./dev~~
	~~MOUNTED="dev $MOUNTED"~~

	~~mount -t devpts devpts ./dev/pts -o nosuid,noexec~~
	~~MOUNTED="pts $MOUNTED"~~

	~~mount -t sysfs sys ./sys -o nosuid,nodev,noexec,ro~~
	~~MOUNTED="sys $MOUNTED"~~

	~~mount -t proc proc ./proc -o nosuid,nodev,noexec~~
	~~MOUNTED="proc $MOUNTED"~~

	~~mount -t tmpfs tmp ./tmp -o mode=1777,nosuid,nodev,strictatime~~
	~~MOUNTED="tmp $MOUNTED"~~
	~~mount -t tmpfs run ./run -o mode=0755,nosuid,nodev~~
	~~MOUNTED="run $MOUNTED"~~
	~~if [ -L ./dev/shm ]; then~~
	~~mkdir -p ./`readlink ./dev/shm`~~
	~~mount -t tmpfs shm ./`readlink ./dev/shm` -o mode=1777,nosuid,nodev~~
	~~else~~
	~~#mkdir -p ./dev/shm~~
	~~mount -t tmpfs shm ./dev/shm -o mode=1777,nosuid,nodev~~
	fi
	~~MOUNTED="shm $MOUNTED"~~

	~~case $1 in~~
	~~-l) shift;;~~
	~~-l*) one=${1#-l~~}~~; shift; set -- -"$one" "$@";;~~
	~~esac~~
	~~chroot . /usr/bin/env -i SHELL=/bin/sh HOME=/root TERM="$TERM" \~~
	~~PATH=/usr/sbin:/usr/bin:/sbin:/bin PS1='chroot # ' /bin/sh -l "$@"~~

	~~# FIXME~~
	~~# are USER and LOGNAME set automatically?~~
	~~# perhaps: source /etc/profile && export PS1="chroot $PS1"~~
	~~</nowiki>~~}}

Zcrayfish: /* Preparation */ remove grsec.

2024-01-13T18:04:10Z

Preparation: remove grsec.

← Older revision		Revision as of 18:04, 13 January 2024
Line 50:		Line 50:
	<li>Set up your network if you'll need it inside the chroot, e.g., to install updated packages. The script presented below will copy the {{Path\|/etc/resolv.conf}} from the host system, but will prompt before overwriting an existing {{Path\|etc/resolv.conf}} inside the chroot. If you like, you can generate one from scratch by doing:		<li>Set up your network if you'll need it inside the chroot, e.g., to install updated packages. The script presented below will copy the {{Path\|/etc/resolv.conf}} from the host system, but will prompt before overwriting an existing {{Path\|etc/resolv.conf}} inside the chroot. If you like, you can generate one from scratch by doing:
	{{Cmd\|echo 'nameserver 8.8.8.8' > $CHROOT/etc/resolv.conf}}		{{Cmd\|echo 'nameserver 8.8.8.8' > $CHROOT/etc/resolv.conf}}

	<li>If your host system is Alpine or another distribution (like Hardened Gentoo) that uses the grsecurity kernel patches, for some maintenance tasks you'll want to make sure some of the grescurity prohibitions are disabled. For example:
	{{Cmd\|sysctl -w kernel.grsecurity.chroot_deny_chmod{{=}}0 # enable suid/sgid<br>sysctl -w kernel.grsecurity.chroot_deny_mknod{{=}}0<br>sysctl -w kernel.grsecurity.chroot_deny_mount{{=}}0<br>sysctl -p}}
	~~For more info, see:~~

	~~<ul type="circle">~~
	~~<li>https://en.wikibooks.org/wiki/Grsecurity~~
	~~<li>https://www.gentoo.org/proj/en/hardened/grsecurity.xml~~
	~~</ul>~~

	</ul>		</ul>

Zcrayfish: /* Other Resources */ Removed ancient+dead Archlinux wiki hyperlink and fixed another.

2023-09-03T10:04:42Z

Other Resources: Removed ancient+dead Archlinux wiki hyperlink and fixed another.

← Older revision		Revision as of 10:04, 3 September 2023
Line 246:		Line 246:

	* [https://superuser.com/questions/111152 What's the proper way to prepare chroot to recover a broken Linux installation?]		* [https://superuser.com/questions/111152 What's the proper way to prepare chroot to recover a broken Linux installation?]
	* [https://wiki.archlinux.org/~~index.php~~/~~Change_Root~~ ArchLinux wiki on "Change Root"]		* [https://wiki.archlinux.org/title/Chroot ArchLinux wiki on "Change Root"]
	* [https://wiki.archlinux.org/index.php/Reinstalling_GRUB ArchLinux Wiki on "Reinstalling GRUB"]
	* [https://web.archive.org/web/20130412163442/http://en.gentoo-wiki.com/wiki/Chroot_from_a_livecd Gentoo Linux Wiki: Chroot from a livecd (via archive.org)]		* [https://web.archive.org/web/20130412163442/http://en.gentoo-wiki.com/wiki/Chroot_from_a_livecd Gentoo Linux Wiki: Chroot from a livecd (via archive.org)]
	* [https://help.ubuntu.com/community/BasicChroot Ubuntu wiki on "Basic chroot"]		* [https://help.ubuntu.com/community/BasicChroot Ubuntu wiki on "Basic chroot"]

	[[Category:System Administration]]		[[Category:System Administration]]

Zcrayfish: This article needs cleanup: grsec stuff needs to go.

2023-08-07T19:32:07Z

This article needs cleanup: grsec stuff needs to go.

← Older revision		Revision as of 19:32, 7 August 2023
Line 1:		Line 1:
	{{Draft}}		{{Draft\|grsec info needs to be removed, we don't use that any more in Alpine Linux.}}

	"Changing root" or "chrooting" is a method for zooming in on part of your filesystem, so that, for example, {{Path\|/path}} will refer to what was formerly accessible at {{Path\|/mnt/path}}. The "root" in the expression "chroot" refers to the root filesystem {{Path\|/}}, not to the root user. (Though typically you will need root user privileges in order to chroot.)		"Changing root" or "chrooting" is a method for zooming in on part of your filesystem, so that, for example, {{Path\|/path}} will refer to what was formerly accessible at {{Path\|/mnt/path}}. The "root" in the expression "chroot" refers to the root filesystem {{Path\|/}}, not to the root user. (Though typically you will need root user privileges in order to chroot.)

Sertonix: use https links

2023-08-07T11:38:39Z

use https links

← Older revision		Revision as of 11:38, 7 August 2023
Line 56:		Line 56:

	<ul type="circle">		<ul type="circle">
	<li>~~http~~://en.wikibooks.org/wiki/Grsecurity		<li>https://en.wikibooks.org/wiki/Grsecurity
	<li>~~http~~://www.gentoo.org/proj/en/hardened/grsecurity.xml		<li>https://www.gentoo.org/proj/en/hardened/grsecurity.xml
	</ul>		</ul>

Line 245:		Line 245:
	== Other Resources ==		== Other Resources ==

	* [~~http~~://superuser.com/questions/111152 What's the proper way to prepare chroot to recover a broken Linux installation?]		* [https://superuser.com/questions/111152 What's the proper way to prepare chroot to recover a broken Linux installation?]
	* [~~http~~://wiki.archlinux.org/index.php/Change_Root ArchLinux wiki on "Change Root"]		* [https://wiki.archlinux.org/index.php/Change_Root ArchLinux wiki on "Change Root"]
	* [~~http~~://wiki.archlinux.org/index.php/Reinstalling_GRUB ArchLinux Wiki on "Reinstalling GRUB"]		* [https://wiki.archlinux.org/index.php/Reinstalling_GRUB ArchLinux Wiki on "Reinstalling GRUB"]
	* [https://web.archive.org/web/20130412163442/http://en.gentoo-wiki.com/wiki/Chroot_from_a_livecd Gentoo Linux Wiki: Chroot from a livecd (via archive.org)]		* [https://web.archive.org/web/20130412163442/http://en.gentoo-wiki.com/wiki/Chroot_from_a_livecd Gentoo Linux Wiki: Chroot from a livecd (via archive.org)]
	* [https://help.ubuntu.com/community/BasicChroot Ubuntu wiki on "Basic chroot"]		* [https://help.ubuntu.com/community/BasicChroot Ubuntu wiki on "Basic chroot"]

	[[Category:System Administration]]		[[Category:System Administration]]

Zcrayfish: /* Other Resources */ Rescued a link via archive.org

2021-12-23T03:09:05Z

Other Resources: Rescued a link via archive.org

← Older revision		Revision as of 03:09, 23 December 2021
Line 248:		Line 248:
	* [http://wiki.archlinux.org/index.php/Change_Root ArchLinux wiki on "Change Root"]		* [http://wiki.archlinux.org/index.php/Change_Root ArchLinux wiki on "Change Root"]
	* [http://wiki.archlinux.org/index.php/Reinstalling_GRUB ArchLinux Wiki on "Reinstalling GRUB"]		* [http://wiki.archlinux.org/index.php/Reinstalling_GRUB ArchLinux Wiki on "Reinstalling GRUB"]
	* [http://en.gentoo-wiki.com/wiki/Chroot_from_a_livecd Gentoo Wiki ~~on "~~Chroot from a livecd"]~~{{dead link}}~~		* [https://web.archive.org/web/20130412163442/http://en.gentoo-wiki.com/wiki/Chroot_from_a_livecd Gentoo Linux Wiki: Chroot from a livecd (via archive.org)]
	* [https://help.ubuntu.com/community/BasicChroot Ubuntu wiki on "Basic chroot"]		* [https://help.ubuntu.com/community/BasicChroot Ubuntu wiki on "Basic chroot"]

	[[Category:System Administration]]		[[Category:System Administration]]