Isn't that what chroots are made for? So a process isn't able to peek outside of it? If the chroot allows for networking then you could export /volume1 on the host as any network filesystem the chroot client can access: NFS, SMB, SSHFS, HTTP, FTP, you get the idea.
|