the other reply alluded to this, but to make it explicit: nothing about this CVE requires docker and it looks like you should be able to do it with a few syscal

the other reply alluded to this, but to make it explicit: nothing about this CVE requires docker and it looks like you should be able to do it with a few syscalls in any process starting with a call to unshare(), unless something else (like selinux) is getting in your way.