How to build a chroot environment on RHEL, CentOS, and Fedora

A chroot gives maintenance and build tools a filesystem tree that appears as the root directory without starting a virtual machine. It is useful for recovery, package inspection, and controlled build work, but it shares the host kernel and does not provide a security boundary.

The DNF package manager can populate an empty directory with the distribution's Core package group before the environment exists. Recent Fedora releases use DNF5 and require host repository configuration to be selected explicitly for an empty install root, while DNF4 on supported RHEL and CentOS releases already falls back to the host repository files.

The host /dev and /sys trees are exposed inside the chroot, so only trusted root processes should enter it. Recursive slave propagation keeps mount and unmount events created below the chroot from propagating back to the corresponding host mount; leave these filesystems mounted only while chroot processes need them.

1. Set the target release to the host distribution's RPM major-release macro.

   $ RELEASEVER=$(rpm -E '%{?rhel}%{?fedora}')

2. Create the chroot root at /var/lib/chroot/fedora.

   $ sudo mkdir -p /var/lib/chroot/fedora

3. Populate the chroot with the Core group, omitting --use-host-config only on DNF4 hosts.

   $ sudo dnf --installroot=/var/lib/chroot/fedora --releasever="$RELEASEVER" --use-host-config --assumeyes install @core

   DNF5 otherwise searches the empty install root for repository configuration. DNF4 automatically falls back to host repository files when the install root has none.
   Related: [DRAFT] How to install a package with DNF explains the package lookup, transaction, and RPM verification used to populate the install root.

4. Bind the host /dev tree recursively into the chroot.

   $ sudo mount --rbind /dev /var/lib/chroot/fedora/dev

5. Change the chroot /dev mount to recursive slave propagation.

   $ sudo mount --make-rslave /var/lib/chroot/fedora/dev

6. Mount a fresh proc filesystem inside the chroot.

   $ sudo mount --types proc proc /var/lib/chroot/fedora/proc

7. Bind the host /sys tree recursively into the chroot.

   $ sudo mount --rbind /sys /var/lib/chroot/fedora/sys

8. Change the chroot /sys mount to recursive slave propagation.

   $ sudo mount --make-rslave /var/lib/chroot/fedora/sys

9. Replace the chroot resolver file with the host's current DNS configuration.

   $ sudo cp --remove-destination /etc/resolv.conf /var/lib/chroot/fedora/etc/resolv.conf

10. Enter the chroot with Bash.

    $ sudo chroot /var/lib/chroot/fedora /bin/bash

11. Verify the base packages from inside the chroot.

    # rpm --query --queryformat '%{NAME} %{VERSION}-%{RELEASE}\n' bash coreutils filesystem
    bash 5.3.9-3.fc44
    coreutils 9.10-4.fc44
    filesystem 3.18-52.fc44

    The package versions vary by distribution and enabled repositories. A nonzero exit or a missing package line means the chroot was not populated with the expected base system.