Add netns and unshare support

docs/configuration/network-namespace/default.md

@@ -0,0 +1,31 @@
+---
+icon: material/new-box
+---
+
+!!! question "Since sing-box 1.14.0"
+
+# Default
+
+Attach to an existing network namespace.
+
+### Structure
+
+```json
+{
+  "network_namespaces": [
+    {
+      "type": "default", // optional
+      "tag": "",
+      "path": ""
+    }
+  ]
+}
+```
+
+### Fields
+
+#### path
+
+==Required==
+
+Name or path of the network namespace, for example `sing` or `/run/netns/sing`.

docs/configuration/network-namespace/default.zh.md

@@ -0,0 +1,31 @@
+---
+icon: material/new-box
+---
+
+!!! question "自 sing-box 1.14.0 起"
+
+# Default
+
+附加到已存在的网络命名空间。
+
+### 结构
+
+```json
+{
+  "network_namespaces": [
+    {
+      "type": "default", // 可选
+      "tag": "",
+      "path": ""
+    }
+  ]
+}
+```
+
+### 字段
+
+#### path
+
+==必填==
+
+网络命名空间的名称或路径，例如 `sing` 或 `/run/netns/sing`。

docs/configuration/network-namespace/index.md

@@ -0,0 +1,43 @@
+---
+icon: material/new-box
+---
+
+!!! question "Since sing-box 1.14.0"
+
+!!! quote ""
+
+    Only supported on Linux.
+
+# Network Namespace
+
+Network namespaces let inbounds and outbounds run inside a separate Linux network namespace,
+referenced by tag from the [tun](/configuration/inbound/tun/#netns),
+[Listen Fields](/configuration/shared/listen/#netns) and [Dial Fields](/configuration/shared/dial/#netns).
+
+### Structure
+
+```json
+{
+  "network_namespaces": [
+    {
+      "type": "",
+      "tag": ""
+    }
+  ]
+}
+```
+
+#### type
+
+The type of the network namespace, `default` is used by default.
+
+| Type      | Format                 |
+|-----------|------------------------|
+| `default` | [Default](./default/)  |
+| `unshare` | [Unshare](./unshare/)  |
+
+#### tag
+
+==Required==
+
+The tag of the network namespace.

docs/configuration/network-namespace/index.zh.md

@@ -0,0 +1,43 @@
+---
+icon: material/new-box
+---
+
+!!! question "自 sing-box 1.14.0 起"
+
+!!! quote ""
+
+    仅支持 Linux。
+
+# 网络命名空间
+
+网络命名空间使入站和出站可以运行在独立的 Linux 网络命名空间中，
+通过标签从 [tun](/zh/configuration/inbound/tun/#netns)、
+[监听字段](/zh/configuration/shared/listen/#netns) 和 [拨号字段](/zh/configuration/shared/dial/#netns) 引用。
+
+### 结构
+
+```json
+{
+  "network_namespaces": [
+    {
+      "type": "",
+      "tag": ""
+    }
+  ]
+}
+```
+
+#### type
+
+网络命名空间的类型，默认使用 `default`。
+
+| 类型      | 格式                   |
+|-----------|------------------------|
+| `default` | [Default](./default/)  |
+| `unshare` | [Unshare](./unshare/)  |
+
+#### tag
+
+==必填==
+
+网络命名空间的标签。

docs/configuration/network-namespace/unshare.md

@@ -0,0 +1,36 @@
+---
+icon: material/new-box
+---
+
+!!! question "Since sing-box 1.14.0"
+
+# Unshare
+
+Create a new network namespace, without root privilege.
+
+!!! info ""
+
+    Rootless operation requires the kernel to allow unprivileged user namespace creation.
+
+### Structure
+
+```json
+{
+  "network_namespaces": [
+    {
+      "type": "unshare",
+      "tag": "",
+      "pid_file": ""
+    }
+  ]
+}
+```
+
+### Fields
+
+#### pid_file
+
+If set, the PID of the process holding the namespace open is written to this path.
+
+The namespace can be entered with `nsenter -t <pid> -n` when sing-box is run as root,
+or `nsenter -t <pid> -U --preserve-credentials -n` otherwise.

docs/configuration/network-namespace/unshare.zh.md

@@ -0,0 +1,36 @@
+---
+icon: material/new-box
+---
+
+!!! question "自 sing-box 1.14.0 起"
+
+# Unshare
+
+创建一个新的网络命名空间，无需 root 权限。
+
+!!! info ""
+
+    无 root 运行需要内核允许非特权用户创建 user namespace。
+
+### 结构
+
+```json
+{
+  "network_namespaces": [
+    {
+      "type": "unshare",
+      "tag": "",
+      "pid_file": ""
+    }
+  ]
+}
+```
+
+### 字段
+
+#### pid_file
+
+如果设置，持有该命名空间的进程 PID 将写入此路径。
+
+当 sing-box 以 root 运行时，可通过 `nsenter -t <pid> -n` 进入该命名空间，
+否则使用 `nsenter -t <pid> -U --preserve-credentials -n`。