Bubblewrap supports user namespaces and has for a while -- grep through the source for CLONE_NEWUSER. I talk about the security concerns a bit in [1]. [1]: htt

Bubblewrap supports user namespaces and has for a while -- grep through the source for CLONE_NEWUSER. I talk about the security concerns a bit in [1]. [1]: https://news.ycombinator.com/item?id=18181034 https://news.ycombinator.com/item?id=18181034