There is an excellent tutorial from LWN about network namespaces also: https://lwn.net/Articles/580893/ https://lwn.net/Articles/580893/ - SubgraphOS uses netw

There is an excellent tutorial from LWN about network namespaces also: https://lwn.net/Articles/580893/ https://lwn.net/Articles/580893/ - SubgraphOS uses network namespaces to isolate individual processes (and route all connections over Tor). As a proof-of-concept, I wrote a small binary that wraps arbitrary binaries in customized namespaces and forwards all traffic over tor instead of masquerading: https://github.com/squeed/torbox https://github.com/squeed/torbox Right now, the torsocks command captures all network syscalls via a LD_PRELOAD shim. My goal was to avoid that sort of hackery.