2 syscalls
setns(2)
Move the calling thread into an existing namespace identified by a file descriptor.
unshare(2)
Disassociate parts of the calling process's execution context — namespaces, fs, files — without forking.