Q: You need to run an untrusted application securely. Explain what a `chroot` jail is and why it shouldn't be your only layer of security.

chroot (Change Root) modifies the root directory (/) for a specific running process and its children. If you chroot an app into /var/jail, the app believes /var/jail is the absolute bottom of the entire filesystem. It physically cannot cd ../../etc to steal system passwords. *Why it's insufficient:* chroot *only* isolates the filesystem view. The application can still see all other processes in the host OS, intercept network traffic, and access host hardware. If the app runs as root inside the jail, knowledgeable attackers can craft system calls to escape the chroot entirely. True isolation requires Linux Namespaces and Cgroups (e.g., Docker containerization), not just chroot.