How to restrict ssh-git user to one repo

How to restrict a ssh-git user to one repo (directory) on a Linux server?

I use git-shell, but the concept of letting users pull git anywhere in the machine, restricted only by fs permission, seems flawed. I don't trust fs permissions to be (and to stay) correct.

I read about chroot jails, and additional programs layered over git. But these days, such things are more cumbersome than firing up a separate VM for each project!

I wish there was something similar to ftp jails, php open_basedir and the like. Please suggest.