fakeroot has nothing to do with qemu -- it simply uses LD preload to make commands think they're uid 0

Fakeroot is good for the debootstrap step, and then schroot runs unprivileged.

> it seems that for creating a chroot you still require root.

You actually don't as long as you have user namespaces.

One thing I am working on I use chroot (rather unshare --root=) to minimally sandbox a subprocess. At the beginning of the script I have this little snippet:

    if [ "$(id --user)" -ne 0 ]; then
     exec unshare --map-root-user --mount -- "$0" "$@"
    fi

Though you can probably just do something roughtly as `unshare --map-root-user --root=<PATH>`.