Creating netns without CAP_NET_ADMIN
managed to get a netns running without sudo on a single thread.
the key is to chain namespaces (for lack of a better term). using unshare with CLONE_NEWNET by itself returns ‘op not permitted error as expected’. But creating a userns followed by netns works succesfully.
Next Step:
I actually need to fork() a process and move it to a namespace spawned by the main thread before exec() an actual process, to see if it persists. The design depends on the main thread tracking all netns to be able to provide knobs for control