wow, very interesting. Thanks!

Looks like mbox doesnt use file system namespaces to isolate a process from fs, but instead combines seccomp and ptrace.

Hm, Ill try to use this to record a programs interactions with the network, tcpdump listens to _all_ the traffic and I havent found a good way yet to filter only on a certain process.

Mbox does a lot more than this.

mbox also uses ptrace which is likely to have more impact on application performances