This article explains the security features of systemd that make chroot superfluous: https://www.redhat.com/en/blog/mastering-systemd

And here's an example of how a network service can be confined in its own network namespace: https://www.cloudnull.io/2019/04/running-services-in-network... - with zero shell needed, btw.