-CMD="unshare -fp --mount-proc ip netns exec $NAME chroot $LIVE /bin/sh"
-echo "$CMD"
-cat <<EOF | $CMD
-set -x
-mount --bind $UPPER/run /run
-for srv in $START ; do service \$srv start ; done
-exec /.reaper $NAME
-EOF
-echo "EXITED $CMD"
-#echo "$STOP" | ip netns exec $NAME chroot $LIVE $SUBSHELL
+# This process has an unshared mount namespace, so we unmount almost
+# everything before chroot. Exceptions are: $LIVE and anything mounted
+# below that, "/run/netns/$NAME" and its parent paths (incidentally
+# including "/" as well) and "/proc".
+sort -rk2,2 < /proc/mounts | while read D P A2 ; do
+ beginswith "$P" "$LIVE" && continue
+ beginswith "$P" "$(realpath $LIVE)" && continue
+ beginswith "/run/netns/$NAME" "$P" && continue
+ [ "$P" = /proc ] && continue
+ umount "$P"
+done
+
+echo "Starting $NAME"
+env CONFIG="$CONFIG" $INIT | \
+ unshare -fp --mount-proc -i -u \
+ ip netns exec $NAME chroot $LIVE /bin/sh
+echo "Exited $NAME"