@@ -20,6 +20,7 @@ func New() *libcontainer.Container {

 			"SETFCAP",

 			"SETPCAP",

 			"NET_BIND_SERVICE",

+			"SYS_CHROOT",

 		},

 		Namespaces: map[string]bool{

 			"NEWNS":  true,

@@ -873,3 +873,15 @@ func TestThatCharacterDevicesActLikeCharacterDevices(t *testing.T) {

 	logDone("run - test that character devices work.")

 }

+

+func TestRunUnprivilegedWithChroot(t *testing.T) {

+	cmd := exec.Command(dockerBinary, "run", "busybox", "chroot", "/", "true")

+

+	if _, err := runCommand(cmd); err != nil {

+		t.Fatal(err)

+	}

+

+	deleteAllContainers()

+

+	logDone("run - unprivileged with chroot")

+}