The unshare tool [1] can be used along with ip-tools to create a namespace with networking support. Add a chroot or pivot root to it and you have a Linux container. It's quite easy to do. We have a guide on using namespaces directly and the various projects using it including Firejail here [2]

Linux namespaces were created to support containers. This is how userland container projects like LXC, Docker and Nspawn work, only they don't use the unshare tool but the underlying system calls clonens, setns and unshare [3].

[1] http://man7.org/linux/man-pages/man2/unshare.2.html

[2] https://www.flockport.com/alternatives-to-docker-and-lxc/

[3] https://lwn.net/Articles/531114/

"ip" will let you futz around with network namespaces in an ad hoc way. There's a good LWN intro to it somewhere.