constrain local files to the specified fs root