To understand just how trivial it is to escape a chroot with root, just run "nsenter -m -t $$" and your out.