Fall back to chroot() if setns() fails for mnt namespace

fixes #347