Network namespace as a regular user

Question

In linux you can create network namespaces, using the ip command. But you need to be root to run that command. However you can still create network namespaces as a regular user using unshare -rUn. With this command, the new network namespace will be owned by a restricted user namespace.

With a new network namespace i can't connect to internet. Creating a veth pair requires root, is there a way to allow my network namespace to connect to the internet without root?. I know that many features like sharing the physical network with the namespace would not be possible. Can you create virtual interfaces like tun0 in a restricted network namespace.

With a network namespace owned by a regular user, you can for example run openvpn without root.

$ create-network-namespace
$ openvpn home.ovpn
$ google-chrome

Answer 1

I found the solution, there already exists a project on github which creates a virtual tap device in the namespace and uses the socket syscall in the host namespace. Every packet sended through TAP will be transformed to a socket operation.

https://github.com/rootless-containers/slirp4netns