While this project already has support for chroot and pivot_root, these features are hardly useful if you want to start anything else than a static linked binary. Thus I added a more powerful feature: fakeroots.

A fakeroot is an initially empty root, where directories from the host can be selectively shared. Shares can be read-only if necessary, providing additional isolation. For example, this code allows read-only access to installed programs but not user data and no write access at all:

cmd.fakeroot_enable("/dev/shm/sandbox_root");cmd.fakeroot_mount("/bin","/bin",true);// add directoriescmd.fakeroot_mount_file("/dev/urandom","/dev/urandom",false);// add files/devicescmd.fakeroot_mount("/etc","/etc",true);cmd.fakeroot_mount("/lib","/lib",true);cmd.fakeroot_mount("/lib64","/lib64",true);cmd.fakeroot_filesystem("proc","/proc");// add custom filesystems (proc or tmpfs)cmd.fakeroot_filesystem("tmpfs","/tmp");cmd.fakeroot_mount("/usr","/usr",true);

The implementation is mostly inspired bynsjail which uses the same syscall sequence.
Supported are: directories, files, devices, and custom filesystems likeproc ortmp.

Availability: If anyone wants to use this and other features before it's merged, check outmy temporary fork. It includes#23#27#29#33#34#35 and#36 with all conflicts resolved.
Add to yourCargo.toml:unshare = { git = "https://github.com/MarkusBauer/unshare.git" }