+ find_network
+ if ! $found; then
+ echo "$0: error: no open network found"
+ exit 1
+ fi
+
+ #### begin mount namespace setup ####
+ mkdir -p /root/mount_namespaces
+ if ! mountpoint /root/mount_namespaces >/dev/null; then
+ mount --bind /root/mount_namespaces /root/mount_namespaces
+ fi
+ # note: This is outside the mount condition because I've mysteriously
+ # had this become shared instead of private, perhaps it
+ # got remounted somehow and lost the setting.
+ mount --make-private /root/mount_namespaces
+ if [[ ! -e /root/mount_namespaces/$nn ]]; then
+ touch /root/mount_namespaces/$nn
+ fi
+ if ! mountpoint /root/mount_namespaces/$nn >/dev/null; then
+ # Here, we specify that we only want mount changes changes under
+ # this mountpoint to be propagated into the bind, but changes
+ # from within the bind do not propagate to outside the bind.
+ #
+ # slave is documented in.
+ # /usr/share/doc/linux-doc-4.9/Documentation/filesystems/sharedsubtree.txt.gz
+ # documentation on propagation is a bit weird because it
+ # confusingly talks about binds, namespaces, and mirrors (which
+ # seems to be just another name for bind), shared subtrees
+ # (which seems to a term for binds and namespaces), and does not
+ # properly specify whether the documentation applies to binds,
+ # namespaces, or both. Notably, propagation for binds is marked
+ # on the original mount point, and propagation for a mount
+ # namespace is marked on mounts within the namespace.
+ unshare --propagation slave --mount=/root/mount_namespaces/$nn /bin/true
+ fi
+
+ #### end mount namespace setup ####
+
+
+ if $create; then
+ ip netns add $nn
+ ip -n $nn link set dev lo up
+ fi
+
+ echo 1 | dexec dd of=/proc/sys/net/ipv4/ip_forward 2>/dev/null
+
+ # docker helpfully changes the default FORWARD to drop...
+ diptables-add FORWARD -i $v0 -j ACCEPT
+ diptables-add FORWARD -o $v0 -j ACCEPT
+
+
+ err-cleanup() { stop; }
+ ipnn link add $v0 type veth peer name $v1
+ ipnn link set $v0 netns default
+ ipd addr add $network.1/24 dev $v0
+ ipd link set $v0 up
+ nat -C &>/dev/null || nat -A
+ ipnn addr add $network.2/24 dev $v1
+ ipnn link set $v1 up
+ ipnn route add default via $network.1
+
+ ###### begin setup resolvconf
+ if [[ -e /run/resolvconf ]]; then # resolvconf probably installed
+ resolv_copy=/root/resolvconf-$nn
+
+ # this condition should never happen, just coding defensively
+ if mexec mountpoint /run/resolvconf &>/dev/null; then
+ mexec umount /run/resolvconf