What it does
After chroot /mnt/sysroot, commands see /mnt/sysroot as /: they use the installed system's programs, config and package database. That is how you reset a password with rd.break, reinstall GRUB or rebuild the initramfs from a rescue disk. For tools like grub2-install or dracut, /proc, /sys, /dev and /run should be mounted inside first (the RHEL rescue mode does this for you).
chroot is not a security boundary; use containers for isolation.
How to write it
chroot [OPTION]... NEWROOT [COMMAND [ARGUMENT]...]Options 6
Most used
Nothing matches this filter.
Examples 10
$ run as a normal user# run as root (or with sudo)
1Enter the installed system from rd.break
mount -o remount,rw /sysroot chroot /sysrootNow passwd works on the real /etc/shadow.
2From the rescue disk
chroot /mnt/sysrootThe rescue mode mounted the system there.
3Mount the special file systems by hand
for d in proc sys dev run; do mount --rbind /$d /mnt/sysroot/$d; done chroot /mnt/sysrootNeeded when you mounted the root yourself.
4Run one command
chroot /mnt/sysroot dracut -f --regenerate-allWithout an interactive shell.
5Reinstall GRUB from rescue
chroot /mnt/sysroot grub2-install /dev/vdaBIOS systems.
6Check packages of the installed system
chroot /mnt/sysroot rpm -qa | grep kernelThe installed kernels, not those of the ISO.
7As another user
chroot --userspec=lisa:lisa /mnt/sysroot /bin/bashTest user rights inside.
8Leave the chroot
Back to the rescue shell.
9Is my shell in a chroot?
ls -di / 2 /An inode number other than 2 (or 128 on btrfs) often means a chroot.
10Do not use it for security
podman run --rm -it registry.access.redhat.com/ubi10/ubi bashContainers isolate with namespaces and SELinux; chroot does not.
Nothing matches this filter.
Exit codes
125 :: chroot itself failed. 126 :: The command could not be run. 127 :: The command was not found. 0 :: Otherwise the exit status of the command.