@a1ba @drq I think my kind of fakeroot replacement would be roughly: bwrap --bind / / --unshare-user --uid 0 --gid 0 -- $command
This way it works without using dynamic linking as a backdoor (I’m the kind which will likely remove things like LD_PRELOAD from the dynamic linker at some point).