A crop of new capabilities

I wonder what the use-cases are for CRIU that require putting a migrated process in the same namespaces as other non-migrated processes.

When it's OK to run the migrated process in its own namespaces, i.e. a container, there isn't really a problem because the migrated process can have (or at least start with) CAP_SYS_ADMIN in those namespaces.