> You can do this with plain unshare + iptables.

But that requires kernel.unprivileged_userns_clone=1 as well as manually setting up ipvlan interfaces and new IP address/routing table, whereas firejail is SUID root and makes the same operation trivially easy.