Kernel patches propose tighter caps for unprivileged user namespaces
A Google-authored series would add a per-namespace capability ceiling and a host-wide sysctl so sandboxes need not expose CAP_NET_ADMIN and friends by default.
By kexecA Google-authored series would add a per-namespace capability ceiling and a host-wide sysctl so sandboxes need not expose CAP_NET_ADMIN and friends by default.
By kexec