unshare — run program with some namespaces unshared from parent
unshare
[options] program
[arguments]
Unshares specified namespaces from parent process and then executes specified program. Unshareable namespaces are:
mounting and unmounting filesystems will not affect
rest of the system (CLONE_NEWNS
flag),
setting hostname, domainname will not affect rest of
the system (CLONE_NEWUTS
flag),
process will have indpendent namespace for System V
message queues, semaphore sets and shared memory
segments (CLONE_NEWIPC
flag),
process will have independent IPv4 and IPv6 stacks,
IP routing tables, firewall rules, the /proc/net
and /sys/class/net
directory trees,
sockets etc. (CLONE_NEWNET
flag).