do not use rootfs directly, hide some directories via bindmount