[zobzu]

to be honest most of the work is done by iproute and unshare in this case. unshare basically calls clone() (syscall) with the correct namespace related paramters, iproute deals with veth.