Just found it: systemd comes with a cool replacement for `chroot(1)` (on Ubuntu it's a separate package `systemd-container`) which not only virtualizes the filesystem root but actually wraps the process in a lightweight container.