We need this for /dev/shm to be present in the target.

We need to bind-mount /sys recursively for efivarfs to be available for
GRUB's use in the target.

While we're here, unmount /dev and /sys recursively when creating an image.