chroot, mount --bind, and binfmt_misc without privilege/setup