Failures in chroot

In our Endless image builder, we chroot into the ostree deployment to install apps with flatpak. The triggers always fail for 2 reasons:

1. The slave mounting of / fails because the deployment directory is not actually a mountpoint. This is easily fixed by doing a bind mount before hand, but I think this can be done in bubblewrap, too. Systemd does this - https://github.com/systemd/systemd/blob/master/src/core/namespace.c#L910.

2. pivot_root fails with EINVAL for reasons I can't quite grok. See https://github.com/torvalds/linux/blob/master/fs/namespace.c#L3035. FWIW, I can't really see why the pivot_root is needed. It seems that you could just build up the newroot, then move the mount over /. This is also what systemd does. It used to use pivot_root, but changed that in https://github.com/systemd/systemd/commit/ac0930c892bc7979b4c9bc2a52e5e844650b025d.