#!/usr/bin/env bash
# runs as root inside the netns + a private mount ns; drops privs, execs cmd.
set -euo pipefail
mount --bind "$NETVM_RESOLV" /etc/resolv.conf
exec setpriv --reuid="$NETVM_UID" --regid="$NETVM_GID" --clear-groups \
  env HOME="$NETVM_HOME" "$@"