All this talk about Unity phoning home got me to thinking that I should just prevent network access and we'll bloody well see how standalone these GoG games are.

First of all, you CAN'T give the namespace NO network. Processes will just crash, for example a lot of Wine processes can't initialize. Also, there may be dlls that bypass network functionality, but your process will die in the ass if no network is initialized. For example GoG Galaxy isn't necessary for single player games installed with offline installers, but there may be a dll that gets hooked. It needs an interface, so I give it loopback.

Secondly, namespaces aren't a lot of fun for users, because they require privileges. CAP_SYS_ADMIN at least and while I could grant my user that with linux capabilities, that's almost as bad as running things as root.

So therefore, these are the gymnastics I settled for, in my Lutris launching command. Trial and error :-)

sudo unshare -n -- sh -c 'ip link set dev lo up; sudo -u grogan lutris'

That will prompt for your user password once (unless it's already cached from recent use in that shell already). The second sudo command will not prompt, because you're downgrading privileges from root, launching as your user in that case.

Then, games launched from lutris will not crash, but fail to connect to the internet. I tested it on the EA App, which launches but fails to log in because it has no internet connectivity.