A light-weight process isolation tool, making use of Linux namespaces and seccomp-bpf syscall filters (with help of the kafel bpf language) Overview What forms of isolation does it provide Which use-cases are supported Isolation of network services (inetd style) Isolation with access to a private, cloned interface (requires root/setuid) Isolation of local processes Isolation of local processes (an