Often won’t work running something like FRR in a container (and therefore it’s own netns,) because it has to update kernel tables etc.

You can do it in a privaledged container afaik though.