However, some privs can be gained in namespaces/unshare.