huh, for some reason i did not know about this utility but it really looks like a better approach. i feel a bit unsure if running in a new user namespace could

huh, for some reason i did not know about this utility but it really looks like a better approach. i feel a bit unsure if running in a new user namespace could break things in subtle ways somehow though. however, it works without user namespace separation too. the cgroup namespace separation is required on my machine to make it work without root for some reason yet unknown to me.