Writing this so I can remember it later: If you try to run sudo in a chroot/systemd-nspawn rootfs of a foreign architecture (via binfmt) and get sudo: effective uid is not 0, is /usr/bin/sudo on a file system with the 'nosuid' option set or an NFS file system without root privileges? it’s because binfmt doesn’t honor the setuid bit by default. Copy /usr/lib/binfmt.d/qemu-<arch>.conf to /etc/binfmt.d/, edit the copy, add a C at the end and restart systemd-binfmt.service.