Comment by aniceperson

Just ... use systemd nspwan ... stop reinventing the wheel ...

it has all the options you would ever want, and is actually deeply aware of the kernel capabilities.

every day someone comes with a new sandbox solution because they are too lazy to read one page documentation.