code: func newChroot(path string) (*chroot, error) {
  	var err error
  	var c chroot
  
  	c.wd, err = os.Getwd()
  	if err != nil {
  		return nil, errwrap.Wrapf("getwd before chroot failed", err)
  	}
  
  	c.root, err = os.Open("/")
  	if err != nil {
  		return nil, errwrap.Wrapf("error opening outer root", err)
  	}
  
  	if err := syscall.Chroot(path); err != nil {
  		return nil, errwrap.Wrapf("chroot to "+path+" failed", err)
  	}
  
  	if err := os.Chdir("/"); err != nil {
  		return nil, errwrap.Wrapf("chdir to \"/\" failed", err)
  	}
  
  	return &c, nil
  }
docs: // newChroot creates a new chroot environment for the given path.
  // Unless the caller calls Escape() all system operations will be invoked in that environment.
  // It stores the working directory at the point it was invoked.