feat: add -N flag to run inside an existing named network namespace

Adds a -N NAME option that launches the wrapped program inside a
pre-existing Linux network namespace (e.g. one set up by the new
netns-sandbox.sh, which routes all traffic through a WireGuard VPN).

Unlike -n, which only unshares/shares the host net, -N keeps the
target namespace's network so the sandboxed process inherits the
namespace's routing, firewall, and VPN-provided DNS. To enter it, wrap
prefixes the launch with 'sudo ip netns exec NAME sudo -u $USER',
dropping back to the invoking user before exec'ing bwrap.

Because the process lives in the namespace's net, -N must not unshare
net: it sets unshare_all=0 and explicitly unshares everything else
(ipc, pid, uts, plus user/cgroup best-effort), mirroring the default
set minus net. It also implies the network binds (resolv.conf, ssl) so
DNS and TLS work, relying on the kernel exposing
/etc/netns/NAME/resolv.conf as /etc/resolv.conf inside the namespace.

Documents the flag under ADVANCED OPTIONS in usage and README.

Author: netpleb

README.md

@@ -76,6 +76,11 @@ By default, Nixwrap will:
 #### Advanced Options
 
 ```
+  -N NAME  Run inside the existing named network namespace NAME. The namespace
+           must already exist (e.g. created by netns-sandbox.sh). wrap enters it
+           via 'sudo ip netns exec NAME' and drops back to the current user
+           before launching. This keeps the namespace's network instead of
+           unsharing net, and implies network access (-n) so DNS and TLS work.
   -p       Do not share current working directory. By default wrap will share
            the current working directory as a write mount and cd into it
            before running the program. With this option, wrap will not share

wrap.sh

@@ -140,8 +140,13 @@ OPTIONS:
   -v       Verbose output for debugging.
 
 ADVANCED OPTIONS:
-  -p       Do not share current working directory. By default wrap will share 
-           the current working directory as a write mount and cd into it 
+  -N NAME  Run inside the existing named network namespace NAME. The namespace
+           must already exist (e.g. created by netns-sandbox.sh). wrap enters it
+           via 'sudo ip netns exec NAME' and drops back to the current user
+           before launching. This keeps the namespace's network instead of
+           unsharing net, and implies network access (-n) so DNS and TLS work.
+  -p       Do not share current working directory. By default wrap will share
+           the current working directory as a write mount and cd into it
            before running the program. With this option, wrap will not share 
            the directory and leave the current directory untouched.
   -f       Force share current working directory. By default wrap will share
@@ -173,8 +178,9 @@ fi
 unshare_all=1
 share_cwd=1
 force_share_cwd=0
+netns=""
 
-while getopts "r:w:e:abcdfhmnpuv" opt; do
+while getopts "r:w:e:N:abcdfhmnpuv" opt; do
   case "$opt" in
 
   # bind / mount a path readonly in sandbox to the same path as host
@@ -270,6 +276,28 @@ while getopts "r:w:e:abcdfhmnpuv" opt; do
     bwrap_opts+=(--ro-bind /etc/static/ssl /etc/static/ssl)
     ;;
 
+  # run inside an existing named network namespace (see netns-sandbox.sh).
+  # the namespace must already exist; wrap will enter it via
+  # `sudo ip netns exec NAME` before launching bwrap, dropping back to the
+  # current user. this keeps the namespace's network (instead of unsharing
+  # net) and implies network access (-n) so that DNS and TLS work.
+  N)
+    netns="$OPTARG"
+
+    # keep the netns' network instead of unsharing net, but still unshare
+    # everything else (mirrors the explicit set documented for -m, minus net)
+    unshare_all=0
+    bwrap_opts+=(--unshare-ipc --unshare-pid --unshare-uts)
+    bwrap_opts+=(--unshare-user-try --unshare-cgroup-try)
+    bwrap_opts+=(--share-net)
+
+    # imply network access binds so resolv.conf / TLS work inside the netns.
+    # the kernel exposes /etc/netns/NAME/resolv.conf as /etc/resolv.conf here.
+    bwrap_opts+=(--ro-bind /etc/resolv.conf /etc/resolv.conf)
+    bwrap_opts+=(--ro-bind /etc/ssl /etc/ssl)
+    bwrap_opts+=(--ro-bind /etc/static/ssl /etc/static/ssl)
+    ;;
+
   # grant audio access
   a)
     bwrap_opts+=(--bind-try "$XDG_RUNTIME_DIR/pulse/native" "$XDG_RUNTIME_DIR/pulse/native")
@@ -383,7 +411,15 @@ for e in "${env_vars[@]}"; do
   fi
 done
 
-exec bwrap \
+# when running inside a named network namespace, enter it via
+# `sudo ip netns exec NAME` and drop back to the current user before bwrap.
+# otherwise the prefix is empty and bwrap runs directly as today.
+netns_prefix=()
+if [[ -n "$netns" ]]; then
+  netns_prefix=(sudo ip netns exec "$netns" sudo -u "$USER")
+fi
+
+exec "${netns_prefix[@]}" bwrap \
   --chdir "$bwrap_chdir" \
   --clearenv \
   --dev /dev \