Runs a command in a separate namespace, isolating network and other system resources