How does it work?

• start with chroot,

• optional "security context" on processes