what about CLONE_NEWNET?

Thanks, I didn’t know about network namespaces; looks like another way to get at per-application packet filtering. I’m glad you work on Native Client. 🙂