I think you're confusing the sandbox set up by `sandstorm-supervisor` with the outer chroot in which the whole server (including the front-end) runs -- typically, `/opt/sandstorm`. The latter one is causing the trouble here. It's created in `run-bundle.c++`. When `sandstorm-supervisor` starts, its root directory usually _isn't_ a mount point.