[throwaway127482]

cgroups aren't relevant here, I think. Not sure if that was just a typo, since you did mention namespaces in the first sentence. PID and user namespaces in particular are relevant here.

[cedws]

Yeah seems you're right, I thought namespaces came under the cgroups umbrella.