Kernel Seeds { unroot }

unroot lets your Linux system enter, modify, and transport any other Linux root filesystem — even across different CPU architectures. It combines rootless multi-user chroots, automatic QEMU emulation, and full-metadata rootfs archives in one small, daemonless binary.

What Can You Do With unroot?

Build for ARM64 on your x86-64 workstation — Extract a Raspberry Pi rootfs archive, enter it as an ordinary user, and use the Pi's own package manager and compiler. When QEMU detects the foreign architecture, it automatically registers a private emulator that's active only inside that rootfs.

# Extract and enter an ARM64 rootfs on x86-64
$ unroot unpack raspi4-rootfs.tar.xz ~/roots/raspi4
$ unroot enter ~/roots/raspi4

# Verify you're running ARM64 binaries through QEMU
bash$ uname -a
Linux workstation 6.6.0 #1 SMP PREEMPT_DYNAMIC aarch64 GNU/Linux

# Use the Pi's native package manager
bash$ sudo apt update
bash$ sudo apt install build-essential

# Compile with the target's toolchain
bash$ cd /home/pi/src/myproject
bash$ make -j32

Become root without sudo — Run trusted builds that expect root privileges inside a private user namespace. Your namespace-root capabilities can't override host permissions, but builds configure and install normally.

Transport entire Linux systems — Pack a rootfs with full metadata preservation (permissions, ACLs, xattrs, file capabilities, SELinux labels) and unpack it on another machine with correct multi-user ownership intact.

Run one command in another userspace — Execute a single program against a different root filesystem without booting VMs or managing container daemons. The process exits normally and leaves no background services behind.

Three Explicit Modes

unroot keeps ownership choices explicit rather than guessing:

• Managed rich roots (default) — Unprivileged multi-user roots using subordinate UID/GID ranges. Perfect for build and packaging work without host root. Private binfmt_misc namespace means emulation is active only inside the rootfs.

• Native roots — Host-owned or mounted filesystems with native ownership. Requires sudo for conventional chroot behavior. Uses host binfmt_misc for system-wide emulation (current boot only).

• Single mode — Run commands as namespace root with the host filesystem visible. Trusted builds needing capabilities without subordinate IDs.

unroot never silently downgrades rich ownership to single-ID or escalates an unprivileged request into host-root execution.

Why unroot Exists

unroot's design was inspired by fchroot, the Funtoo Linux franken-chroot tool that used QEMU to allow chrooting into non-x86 systems. fchroot demonstrated the power of transparent cross-architecture execution, but it required root access and was tied to Funtoo's infrastructure.

unroot improves on this foundation with rootless operation using user namespaces, private binfmt_misc emulation that doesn't affect your host system, built-in pack/unpack commands for rootfs transport, and multiple explicit modes. It brings together everything you need in one binary with no background services.

No container daemons. No hand-crafted chroot setups. No host-wide emulation configuration. Just one tool that does exactly what you need.

Getting Started

# Enter a rootfs
$ unroot enter ~/rootfs

# Unpack an ARM64 Raspberry Pi rootfs on your x86-64 workstation
$ unroot unpack raspi4-rootfs.tar.xz ~/roots/raspi4
$ unroot enter ~/roots/raspi4

# Build as namespace root without sudo
$ unroot single --persist-env PATH -- make -j32

# Pack a modified rootfs for transport
$ unroot pack ~/roots/raspi4 raspi4-modified.tar.zst

For complete usage examples and detailed documentation, see the README.

Security Model

unroot is designed for trusted build, packaging, and rootfs-maintenance workloads. It is not a hostile-code sandbox:

• ✓ Private mount and PID namespaces
• ✓ User namespace isolation (rich roots and single mode)
• ✓ Namespace root ≠ host root
• ✗ Shared network, IPC, hostname, cgroups, and kernel
• ✗ No syscall filters, resource limits, or MAC policies

Use unroot with root filesystems and commands you trust.

Requirements

• Linux with user namespace support
• unroot-util and subordinate UID/GID allocations for rich roots (configured in /etc/subuid and /etc/subgid)
• Host root privileges for native mode
• Static QEMU user-mode emulator for foreign architecture execution (recommended but not required)

Native packages are available for Debian 13, Ubuntu 24.04/26.04, Fedora 44, and Enterprise Linux 9. QEMU is a recommended dependency for multi-architecture support but not required for native roots.

unroot is a focused Kernel Seeds project with its own release boundary and test matrix.