Isolate filesystem on every panel FS operation using namespaces for additional security

[caukub]

I think additional layer of filesystem security could be added using namespaces. That basically means to "isolate" filesystem to the user directory when FS operation will be performed so it would be impossible to access outer files on OS level similar to how container runtimes like Docker do that. How can that be done specifically is described in this article.

P. S. I have not looked into how new Ptero filesystem implementation works after last CVE so this may not be needed already