lock chroot

prevent breach even with relative path for ```getInitialCwd```