Arch removed the package that allowed sandboxes to function while unprivileged user namespaces stayed disabled, and there is no replacement for it. Ditana reverses the arrangement instead: a namespace is refused to everything that has not been explicitly declared, and a BPF program on the kernel’s userns_create hook enforces that. A machine that cannot load the program keeps namespaces entirely switched off, so a failure costs sandboxes and never protection.
…