kaos spins up isolated network namespaces, wires them together with veth pairs, and degrades the links (latency, loss) so networked software can be tested under realistic conditions. It does all of this without CAP_NET_ADMIN, by nesting a network namespace inside a user namespace and driving everything over netlink.