sandbox: Use pivot_root and not chroot