he is not running in a container - he is not running the command in isolation from the system, he is running on the current system. The script is mounting an overlay file system for each root directory on the current system, then looking at what has been added as a new layer - that's what the command is supposed to add to the running system.

Pure genius.

See https://github.com/binpash/try/blob/b2df6b650cb2b58951563174...