---
title: "Discussion on \"Why Docker Uses pivot_root (and Not Just chroot)\" | Hashnode"
description: "Discussion on \"Why Docker Uses pivot_root (and Not Just chroot)\". When you run docker run alpine sh and type ls /, you see Alpine's files — bin, etc, lib — and nothing from your actual machine. Your home folder, your SSH keys, your /etc/shadow: none of them are ther"
url: "https://hashnode.com/posts/why-docker-uses-pivot-root-and-not-just-chroot/6ada0a0970561a460423373d"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Why Docker Uses pivot\_root (and Not Just chroot)](https://amirkolahi.ir/why-docker-uses-pivot-root-and-not-just-chroot?utm_source=hashnode&utm_medium=feed)

When you run docker run alpine sh and type ls /, you see Alpine's files — bin, etc, lib — and nothing from your actual machine. Your home folder, your SSH keys, your /etc/shadow: none of them are ther

Oct 22 · 8 min read · amirkolahi.ir  
Read the article

## Written by

[Amir Kolahi](https://hashnode.com/@echoamir)

@echoamir

  
[View profile](https://hashnode.com/@echoamir)

DevOps

## Responses 1

Markdown supported · ⌘↵ to post

[Abhinav Sharma](https://hashnode.com/@abhinavs1920)

[Oct 22](https://hashnode.com/posts/why-docker-uses-pivot-root-and-not-just-chroot/6ada0a0970561a460423373d/comment/6ada415623803b5822766e36)

The chroot-escapes-through-open-handles point is what sells pivot\_root: chroot only changes where a process thinks root is, while the old root stays mounted and reachable, and pivot\_root actually swaps the mount so the host tree can be unmounted. Isolation by removal beats isolation by redirection.