Giving different groups of processes their own view of global kernel
resources—network environments and filesystem trees for
example—is one of the goals of the kernel container developers.  These
views, or namespaces, are created as part of a clone() with one of
the
CLONE_NEW* flags and are only visible to
the new process and its children.  Eric Biederman has proposed a mechanism that would
allow other processes, outside of the namespace-creator's descendants, to
see and
access those namespaces.