My answer, FWIW, is there is no safe way to clone an SD card. The ideal way is to customize the Linux_for_Tegra/rootfs (eg, with chroot and qemu-user-static), then run Linux_for_Tegra/apply_binaries.sh and then flash or create a SD card image from that rootfs using either Linux_for_Tegra/flash.sh or the image creation script in Linux_for_Tegra/tools
Linux_for_Tegra in the download paths created by SDK manager or by extracting the BSP tarball. If you want to customize the rootfs, you must also extract the rootfs tarball at the path specified. These files should be extracted on a linux desktop machine.
Please see the developer documentation for detailed instructions on rootfs customization. Chroot is not covered, I believe, but you can ask here if you need help installing a package on the rootfs prior to flash.
The reason it’s not safe to clone an SD card is becuase certain things are set on first boot that must remain unique or you will have network and security issues (eg. identical ssh host keys). This applies to any platform. There are tools that can strip out the unique bits, but none are perfect and none that I know of exist for Tegra.