I found this page which explains exactly what I was trying to do to chroot into the target filesystem:
It's then a simple case of running
adduser ubuntu or similar.
Copied in case it goes dead:
Chroot'ing into the Ubuntu Core Filesystem
One solution to customize your Ubuntu Core Filesystem is to do it from the Linux PC. Using a 'chroot' is sometimes quite convinient as you can run commands as you normally do on the ARM target. Here are some quick steps to get running:
Chroot configuration on the Linux PC
Verify that on your Linux PC you have the 'qemu-user-static' Ubuntu package installed. This can be done with the following command line (on your Linux PC):
dpkg -l qemu-user-static
Have your SD Card mounted on your Linux PC and go to your rootfs Ubuntu Core folder, generally:
Copy the qemu for arm file:
cp /usr/bin/qemu-arm-static usr/bin/
If not done yet, have your network settings properly configured:
mv etc/resolv.conf etc/resolv.conf.saved
cp /etc/resolv.conf etc/resolv.conf
Then, mount sys, proc and dev:
for m in `echo 'sys dev proc'`; do sudo mount /$m ./$m -o bind; done
Finally, chroot into your target filesystem:
sudo LC_ALL=C chroot . /bin/bash
You are now in your 'chroot' which means you can run commands like if you were on your target ARM device.
Using the 'chroot'
The first step is to verify the network connection is fine. You can run:
You are now ready to install any new package in your Ubuntu Core Filesystem using APT tools.
Getting out of the 'chroot'
Un-mount the target filesystem:
Make sure your at the / target FS and run the following commands:
for m in `echo 'sys dev proc'`; do sudo umount ./$m; done
Go back to your original network settings:
mv etc/resolv.conf.saved etc/resolv.conf