in zinc compile hermetic, for example, we always execute with cwd=get_buildroot() basically