tp

Enhanced network isolation with IPv6 support, DNS redirection, and reliable FD passing for stable transparent proxy.

Switch from user namespace privilege isolation to host-level root with sudo, preserving original user identity for the target program to simplify capability management and avoid namespace mapping complexities.

Map host UID/GID to root in container namespace to retain CAP_NET_ADMIN for TUN device setup and network configuration.

Refactor from single-process design to safer multi-process re-exec pattern, solving namespace isolation for Go multi-threaded runtime by splitting launcher and worker roles.

Replace direct root requirement with Linux user namespaces to enable unprivileged CAP_NET_ADMIN for secure network isolation without host privilege escalation.