Kernel Seeds { News/Updates }

Today, I'm announcing the initial public release of unroot 1.0.0, a Linux root filesystem super-tool that lets you enter, modify, and transport any Linux root filesystem — even across different CPU architectures.

unroot brings together capabilities that previously required multiple tools: manual chroot setup, host-wide binfmt_misc configuration, careful tar flags to preserve metadata, and sudo for everything. It's a focused Kernel Seeds project with its own release boundary and test matrix.

From fchroot to unroot

unroot's design was inspired by fchroot, the Funtoo Linux franken-chroot tool that used QEMU to allow chrooting into non-x86 systems. fchroot demonstrated the power of transparent cross-architecture execution, but it required root access and was a Funtoo-specific tool.

unroot improves on this foundation in several important ways:

• Rootless operation — Managed rich roots use user namespaces and subordinate UID/GID ranges, allowing unprivileged multi-user chroots without host root privileges.

• Private emulation — Rich roots use a private binfmt_misc namespace, so QEMU emulation is active only inside the rootfs and doesn't affect your host system.

• Rootfs transport — Built-in pack and unpack commands preserve full metadata (permissions, ACLs, xattrs, file capabilities, SELinux labels) when moving root filesystems between machines.

• Multiple modes — Choose from managed rich roots (default), native roots for host-owned filesystems, or single mode for namespace-root builds without a rootfs.

• Distribution independence — Native packages for Debian, Ubuntu, Fedora, and Enterprise Linux, with static binaries for any Linux distribution.

What unroot 1.0.0 Delivers

The initial release focuses on dependable rootfs entry and transport:

Cross-architecture execution — unroot automatically detects foreign architectures and selects appropriate QEMU emulators. Build for ARM64 on your x86-64 workstation using the target's own toolchain, not cross-compilation.

$ unroot unpack raspi4-rootfs.tar.xz ~/roots/raspi4
$ unroot enter ~/roots/raspi4
# uname -a
Linux workstation 6.6.0 #1 SMP PREEMPT_DYNAMIC aarch64 GNU/Linux
# cat /etc/os-release
NAME="Raspberry Pi OS"
VERSION="12 (bookworm)"

Rootless multi-user chroots — Preserve complete filesystem ownership without host root. Subordinate UID/GID ranges map to the rootfs's users and groups, recorded in .unroot/meta.json and validated on every entry.

Namespace-isolated root builds — Run trusted builds that expect root privileges in single mode. Your namespace-root capabilities can't override host permissions, but builds configure and install normally.

$ unroot single --persist-env PATH -- make -j32 install

Full-metadata archives — Pack and unpack root filesystems with complete fidelity, including sparse files, POSIX ACLs, extended attributes, and file capabilities.

$ unroot pack ~/roots/raspi4 raspi4-modified.tar.zst

Explicit modes, no guessing — unroot never silently downgrades rich ownership to single-ID or escalates an unprivileged request into host-root execution. You choose the mode; unroot enforces it.

Security Model

unroot is designed for trusted build, packaging, and rootfs-maintenance workloads. It is not a hostile-code sandbox.

• ✓ Private mount and PID namespaces
• ✓ User namespace isolation (rich roots and single mode)
• ✓ Namespace root ≠ host root
• ✗ Shared network, IPC, hostname, cgroups, and kernel
• ✗ No syscall filters, resource limits, or MAC policies

Use unroot with root filesystems and commands you trust.

Availability

unroot 1.0.0 is available now for:

• Static binaries — x86-64 and ARM64
• Debian packages — Debian 13, Ubuntu 24.04/26.04
• RPM packages — Fedora 44, Enterprise Linux 9 (Rocky Linux 9)
• Source archive — Build from source with GNU Make and a C++17 compiler

QEMU user-mode emulation is recommended for multi-architecture support but not required — unroot works without it for native same-architecture roots.

Get unroot

Download unroot 1.0.0 from the GitHub release page or visit the unroot project page for documentation and usage examples.

Report issues on the GitHub issue tracker or consult the README for complete usage instructions.

unroot joins Keychain and Sprouted Code in the Kernel Seeds catalog — focused open source tools with roots, built to solve real problems without unnecessary complexity.