[Question] bubblewrap with network namespaces

It has been discussed before here and the problem seemed to have to do with privilege.

But assuming you don't care to be unprivileged when you do it, how do you force a piece of software you bubble wrapped to be using a separate namespace?

Is there any downside to doing:

`sudo ip netns exec netns1 bwrap ...`

The above will launch bwrap as root, is bwrap able to deal with that satisfactorily?

If not:

`sudo -E ip netns exec netns1 sudo -E -u \#$(id -u) -g \#$(id -g) bwrap ...`

Is there a problem with this?

Perhaps use opendoas instead of sudo.