Hello, we are evaluating a sandboxed image-decoding worker on the Hobby plan. In an isolated synthetic test service (Debian bookworm, Python 3.11.16, bubblewrap 0.8.0-2+deb12u1, uid 0), CPU, address-space and wall-time limits worked, but bubblewrap exited with: "bwrap: Creating new namespace failed: Permission denied". The command requested user, PID, network, IPC and UTS namespaces plus a restricted mount namespace. No customer files or application credentials were used, and the one-shot deployment has been removed.

Can you confirm whether nested user/mount/network namespaces are supported in standard Railway containers on Hobby? Is there a documented, supported configuration for bubblewrap or another per-process sandbox that restricts filesystem access and denies network access to an image decoder? If these capabilities are unavailable, is there another Railway execution product suitable for this workload on Hobby, and how does its billing differ?

We need platform capability guidance only. Please do not change services, permissions, plans or billing. Please link the relevant documentation and distinguish supported behavior from a suggested workaround. Thank you.