[touisteur]

Do you need a user namespace? I'd expect a network namespace to be enough. Am I missing something?

Edit: should've read better, this seems to need CLONE_NEWUSER.

[jwilk]

You need CAP_SYS_ADMIN to create a new network namespace.