[comex]

> Some operating systems attempt to provide more secure chroot jails, but linux chroot() does not provide this.

Note that this includes Linux itself with CLONE_NEWNS + pivot_root (which is what Docker does).

[geofft]

Oh! I didn't know Docker used pivot_root, and I was always curious why that call and chroot() both existed. This makes some sense.