The text 395bdf7aa81a, as Debian 9 (Stretch) shipped it.
Run a task in a new set of namespaces.
lxc-unshare(1) on Linux now