Chroot allows user based namespace isolation on many standard Linux deployments.

## 1. Prerequisites

- Familiarity with [chroot](http://man7.org/linux/man-pages/man2/chroot.2.html)
- Chroot installed on your machine.

## 2. Install MinIO in Chroot

```sh
mkdir -p /mnt/export/${USER}/bin

	if [ -n "${MINIO_USERNAME}" ] && [ -n "${MINIO_GROUPNAME}" ]; then
		if [ -n "${MINIO_UID}" ] && [ -n "${MINIO_GID}" ]; then
			chroot --userspec=${MINIO_UID}:${MINIO_GID} / "$@"
		else
			echo "${MINIO_USERNAME}:x:1000:1000:${MINIO_USERNAME}:/:/sbin/nologin" >>/etc/passwd
			echo "${MINIO_GROUPNAME}:x:1000" >>/etc/group
			chroot --userspec=${MINIO_USERNAME}:${MINIO_GROUPNAME} / "$@"
		fi
	else
		exec "$@"
	fi
}

pkg syscall (freebsd-386-cgo), func BpfTimeout(int) (*Timeval, error)
pkg syscall (freebsd-386-cgo), func CheckBpfVersion(int) error
pkg syscall (freebsd-386-cgo), func Chflags(string, int) error
pkg syscall (freebsd-386-cgo), func Chroot(string) error
pkg syscall (freebsd-386-cgo), func Close(int) error
pkg syscall (freebsd-386-cgo), func CloseOnExec(int)
pkg syscall (freebsd-386-cgo), func CmsgLen(int) int

pkg syscall (darwin-386), func BpfTimeout(int) (*Timeval, error)
pkg syscall (darwin-386), func CheckBpfVersion(int) error
pkg syscall (darwin-386), func Chflags(string, int) error
pkg syscall (darwin-386), func Chroot(string) error
pkg syscall (darwin-386), func Close(int) error
pkg syscall (darwin-386), func CloseOnExec(int)
pkg syscall (darwin-386), func CmsgLen(int) int
pkg syscall (darwin-386), func CmsgSpace(int) int

pkg syscall (netbsd-arm64-cgo), func CheckBpfVersion(int) error
pkg syscall (netbsd-arm64-cgo), func Chflags(string, int) error
pkg syscall (netbsd-arm64-cgo), func Chroot(string) error
pkg syscall (netbsd-arm64-cgo), func Close(int) error
pkg syscall (netbsd-arm64-cgo), func CloseOnExec(int)
pkg syscall (netbsd-arm64-cgo), func CmsgLen(int) int

pkg syscall (freebsd-arm64), func CheckBpfVersion //deprecated
pkg syscall (freebsd-arm64), func CheckBpfVersion(int) error
pkg syscall (freebsd-arm64), func Chflags(string, int) error
pkg syscall (freebsd-arm64), func Chroot(string) error
pkg syscall (freebsd-arm64), func Close(int) error
pkg syscall (freebsd-arm64), func CloseOnExec(int)
pkg syscall (freebsd-arm64), func CmsgLen(int) int
pkg syscall (freebsd-arm64), func CmsgSpace(int) int

pkg syscall (darwin-arm64), func CheckBpfVersion //deprecated
pkg syscall (darwin-arm64), func CheckBpfVersion(int) error
pkg syscall (darwin-arm64), func Chflags(string, int) error
pkg syscall (darwin-arm64), func Chroot(string) error
pkg syscall (darwin-arm64), func Close(int) error
pkg syscall (darwin-arm64), func CloseOnExec(int)
pkg syscall (darwin-arm64), func CmsgLen(int) int
pkg syscall (darwin-arm64), func CmsgSpace(int) int

pkg syscall (freebsd-riscv64), func CheckBpfVersion(int) error #53466
pkg syscall (freebsd-riscv64), func Chflags(string, int) error #53466
pkg syscall (freebsd-riscv64), func Chroot(string) error #53466
pkg syscall (freebsd-riscv64), func Close(int) error #53466
pkg syscall (freebsd-riscv64), func CloseOnExec(int) #53466
pkg syscall (freebsd-riscv64), func CmsgLen(int) int #53466

    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ matrix.go-version }}
          check-latest: true
      - name: Start root lockdown tests
        run: |

if [ $? -ne 0 ]; then
	echo "listing failed, 'minioadmin' should be enabled"
	exit 1
fi

killall -9 minio

rm -rf /tmp/multisitea/
rm -rf /tmp/multisiteb/

echo "Setup site-replication and then disable root credentials"

minio server --address 127.0.0.1:9001 "http://127.0.0.1:9001/tmp/multisitea/data/disterasure/xl{1...4}" \
	"http://127.0.0.1:9002/tmp/multisitea/data/disterasure/xl{5...8}" >/tmp/sitea_1.log 2>&1 &