&gt; Especially with containers, this is a never-ending target... They apparently have user namespaces, but what about network namespaces or IPC namespaces?<p>There&#x27;s no reason calls to e.g. unshare(2) and setns(2) can&#x27;t be added to forkAndExecInChild in exec_linux.go like they have been added for the other syscalls needed to set up a child. I guess if anyone is reading this thread and wants that they can follow the guidelines for contributions and look at <a href="https:&#x2F;&#x2F;github.com&#x2F;golang&#x2F;go&#x2F;issues&#x2F;5968" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;golang&#x2F;go&#x2F;issues&#x2F;5968</a><p>EDIT: It&#x27;s also possible to supply CloneFlags though the SysProcAttr struct, e.g., CLONE_NEWIPC, CLONE_NEWNET.