Linux sandboxing tool using user namespaces to let unprivileged users isolate processes without root.