Btw, at this point I'm done with this set. The set does work for me, I'm happy to either apply it (with acks) or not, but either way feedback much appreciated. I'll be out next week, so handling of networking for unprivileged containers will have to wait until I'm back. -serge