> > Can you elaborate what exactly the issues is? I use this quite often.
> It's a container escape. The chroot shouldn't be able to access the hosts tmp files. Creating a tmpfs and using that is a safer method. If you can read and write the hosts tmpfs, then you can impact the behaviour of the host.
ok ja, I know, I am also mounting /home. There are no guarantees that there is any security gain by using this and security is not the goal of this software.
> For /dev it's just because it has to be a proper bind, and I haven't looked deeply enough to check that happens.
I am using `mount("/dev", "./rootfs/dev", "none", MS_MGC_VAL|MS_BIND|MS_REC, NULL)` so a recursive bind so we also get stuff like "/dev/pts". I am using this regularly and it works perfect for me, let me know if you know of any specific problems with this!