I think valve uses user namespaces if available nowadays. This also checks that devs arent accidentally relying on libs outside of the runtime. (Aside from mesa and libc of course)