Locking Down System Resources with Namespaces

Leverage process namespaces to provide a restricted view of the filesystem to untrusted application processes.