Rating:

Escape from chroot and access initrd.

The trick is to umount / and reenter our mount namespace. See URL for full details.

Original writeup (http://jgeralnik.github.io/writeups/2021/08/09/beyond_root/).