namespaces The child process created … with the CLONE_NEWUSER flag starts out with a complete set of capabilities in the new user namespace. man user_namespaces
namespaces The child process created … with the CLONE_NEWUSER flag starts out with a complete set of capabilities in the new user namespace. If CLONE_NEWUSER is specified along with other CLONE_NEW* flags … the user namespace is guaranteed to be created first, giving the child … privileges over the remaining namespaces created by the call. man user_namespaces