Not to minimize their work, which is actually amazing!

you wouldn’t know because…

Still based on GNOME.

you don’t have a single clue about what they are actually doing.

start a process within a specific veth

That sentence doesn’t make any sense.

Processes run in network namespaces (netns), and that’s exactly what ip netns exec does.

A newly created netns via ip netns add has no network connectivity at all. Even (private) localhost is down and you have to run ip link set lo up to bring it up.

You use veth pairs to connect a virtual device in a network namespace, with a virtual device in the default namespace (or another namespace with internet connectivity).

You route the VPN server address via the netns veth device and nothing else. Then you run wireguard/OpenVPN inside netns.

Avoid using systemd since it runs in the default netns by default, even if called from a process running in another netns.

The way I do it is:

1. A script for all the network setup:

ns_con AA

2. A script to run a process in a netns (basically a wrapper around ip netns exec):

ns_run AA <cmd>

3. Run a termnal app using 2.
4. Run a tmux session on a separate socket inside terminal app. e.g.

export DISPLAY=:0 # for X11
export XDG_RUNTIME_DIR=/run/user/1000 # to connect to already running pipewire...
# double check this is running in AA ns
tmux -f -f <alternative_config_file_if_needed> -L NS_AA

I have this in my tmux config:

set-option -g status-left "[#{b:socket_path}:#I] "

So I always know which socket a tmux session is running on. You can include network info there if you’re still not confident in your setup.

Now, I can detach that tmux session. Reattaching with tmux -L NS_AA attach from anywhere will give me the session still running in AA.

You don’t even need full-fledged containers for that btw.

Learn how to script with ip netns and veth.

What alternative would you suggest?

A, rolling release first, distro (e.g. Arch or Void) with no DE installed.
But you’re probably not ready for that.
For me, a terminal and Firefox are the only GUI apps really needed. mpv too if it counts.
But I’m someone who has been running Arch+AwesomeWM for ~15 years ago (been using Arch for even longer). So I probably can’t meaningfully put myself in new users’ shoes.

Is your browser Firefox?
What kind of storage devices do you have? NVMe?
Did you check with tools like iotop to see if something is going on IO wise?

You assumed that the problem is caused by the CPU being utilized at 100%.
This may not be the case.

A lot of us don’t run a DE at all. I myself use Awesome WM.
For non-tilers, Openbox with some toolbar would be the ideal setup.

I mention this because we (non-DE users) would have no experience with some funky stuff like a possible KDE indexer running in the background killing IO performance and thrashing buffered/cached memory.

Also, some of us run firefox with eatmydata because we hate fsync 🤨

Neither KDE nor Gnome is peak Desktop Linux experience.
Ubuntu and its flavors is not peak distro experience either.

If you want to try Desktop Linux for real, you will need to dip your toes a little bit deeper.

P.S. Since it wasn’t mentioned already, look up cgroups.

Back when I had a humble laptop (pre-Rust), using nice and co. didn’t help much. Custom schedulers come with their own stability and worst-case-scenario baggage. cgroups should give you supported and well-tested tunable kernel-level resource usage control.

This hasn’t been my experience when no swapping is involved (not a concern for me anymore with 32GiB physical RAM with 28GiB zram).

And I’ve been Rusting since v1.0, and Linuxing for even longer.

And my setup is boring (and stable), using Arch’s LTS kernel which is built with CONFIG_HZ=300. Long gone are the days of running linux-ck.

Although I do use craneleft backend now day to day, so compiles don’t take too long anyway.

DNS blockers became a thing in part because /etc/hosts can’t do stuff like glob subdomain blocking, no?

e.g.

*.bla.tld 127.0.0.1

don’t do it during working hours (especially commits - if you’re paranoid, use tor)

I wanted to mention not using personal emails or committing from home IP addresses, but thought that was needless to say.

Meh, everyone scaring you into thinking you don’t own your own mind.

Assuming your boss is not the dangerous kind (beyond legal threats), and if the goal is to make it FOSS, then do it using an alias first. Do it differently. Use components/libs/algos from other people at first, even if they are not perfect. Make those parts easily pluggable/replaceable which would be good design anyway. The code then wouldn’t be wholly yours, not even your alias self.

You can join the project later with your real identity as an interested domain expert (maybe a bit after not working for the same boss). Start contributing. Become a maintainer. And maybe take over after a while. You can start replacing non-optimal components/libs/algos with better ones piecemeal.

Oh, and if Rust wasn’t the choice of implementation, use it this time.