Rudimentary sandbox for running a program in its independent PID/hostname/mount namespaces, and with restricted access to file system, limited resource usage, optional privileged capabilities. - View it on GitHub