It's also quite special as it needs raw socket access (doesn't it work in connect() mode though?), it is on the backlog though as I understand.

Other things that won't work are fuse and VPN's and loading arbitrary kernel drivers (it's surprising how many people don't seem to get that it only implements userland compatibility)