[cedws]

Can’t SUID binaries in chroots be ignored, like the nosuid mount flag?

[blueflow]

Linux namespaces can do that, with a UID namespace, you drop the ability to do SUID, and then you can open a mount namespace and bind-mount and chroot as you like.