diff --git a/Cargo.lock b/Cargo.lock
index 7308929..3d4beac 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -229,7 +229,7 @@ dependencies = [
  "futures-lite 2.0.1",
  "parking",
  "polling 3.3.1",
- "rustix 0.38.25",
+ "rustix 0.38.26",
  "slab",
  "tracing",
  "windows-sys 0.52.0",
@@ -268,7 +268,7 @@ dependencies = [
  "cfg-if",
  "event-listener 3.1.0",
  "futures-lite 1.13.0",
- "rustix 0.38.25",
+ "rustix 0.38.26",
  "windows-sys 0.48.0",
 ]
 
@@ -295,7 +295,7 @@ dependencies = [
  "cfg-if",
  "futures-core",
  "futures-io",
- "rustix 0.38.25",
+ "rustix 0.38.26",
  "signal-hook-registry",
  "slab",
  "windows-sys 0.48.0",
@@ -362,11 +362,11 @@ checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
 
 [[package]]
 name = "atomic-write-file"
-version = "0.1.0"
+version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c232177ba50b16fe7a4588495bd474a62a9e45a8e4ca6fd7d0b7ac29d164631e"
+checksum = "edcdbedc2236483ab103a53415653d6b4442ea6141baf1ffa85df29635e88436"
 dependencies = [
- "nix",
+ "nix 0.27.1",
  "rand",
 ]
 
@@ -550,9 +550,9 @@ checksum = "28c122c3980598d243d63d9a704629a2d748d101f278052ff068be5a4423ab6f"
 
 [[package]]
 name = "core-foundation"
-version = "0.9.3"
+version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "194a7a9e6de53fa55116934067c844d9d749312f75c6f6d0980e8c252f8c2146"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -560,9 +560,9 @@ dependencies = [
 
 [[package]]
 name = "core-foundation-sys"
-version = "0.8.4"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e496a50fda8aacccc86d7529e2c1e0892dbd0f898a6b5645b5561b89c3210efa"
+checksum = "06ea2b9bc92be3c2baa9334a323ebca2d6f074ff852cd1d7b11064035cd3868f"
 
 [[package]]
 name = "cpufeatures"
@@ -746,12 +746,12 @@ checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
 
 [[package]]
 name = "errno"
-version = "0.3.7"
+version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f258a7194e7f7c2a7837a8913aeab7fd8c383457034fa20ce4dd3dcb813e8eb8"
+checksum = "a258e46cdc063eb8519c00b9fc845fc47bcfca4130e2f08e88665ceda8474245"
 dependencies = [
  "libc",
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -1204,9 +1204,9 @@ checksum = "af150ab688ff2122fcef229be89cb50dd66af9e01a4ff320cc137eecc9bacc38"
 
 [[package]]
 name = "js-sys"
-version = "0.3.65"
+version = "0.3.66"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54c0c35952f67de54bb584e9fd912b3023117cbafc0a77d8f3dee1fb5f572fe8"
+checksum = "cee9c64da59eae3b50095c18d3e74f8b73c0b86d2792824ff01bbce68ba229ca"
 dependencies = [
  "wasm-bindgen",
 ]
@@ -1286,9 +1286,9 @@ checksum = "ef53942eb7bf7ff43a617b3e2c1c4a5ecf5944a7c1bc12d7ee39bbb15e5c1519"
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.4.11"
+version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "969488b55f8ac402214f3f5fd243ebb7206cf82de60d3172994707a4bcc2b829"
+checksum = "c4cd1a83af159aa67994778be9070f0ae1bd732942279cabb14f86f986a21456"
 
 [[package]]
 name = "lock_api"
@@ -1401,7 +1401,17 @@ dependencies = [
  "cfg-if",
  "libc",
  "memoffset",
- "pin-utils",
+]
+
+[[package]]
+name = "nix"
+version = "0.27.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2eb04e9c688eff1c89d72b407f168cf79bb9e867a9d3323ed6c01519eb9cc053"
+dependencies = [
+ "bitflags 2.4.1",
+ "cfg-if",
+ "libc",
 ]
 
 [[package]]
@@ -1656,7 +1666,7 @@ dependencies = [
  "cfg-if",
  "concurrent-queue",
  "pin-project-lite",
- "rustix 0.38.25",
+ "rustix 0.38.26",
  "tracing",
  "windows-sys 0.52.0",
 ]
@@ -1771,9 +1781,9 @@ checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
 
 [[package]]
 name = "rsa"
-version = "0.9.4"
+version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a3211b01eea83d80687da9eef70e39d65144a3894866a5153a2723e425a157f"
+checksum = "af6c4b23d99685a1408194da11270ef8e9809aff951cc70ec9b17350b087e474"
 dependencies = [
  "const-oid",
  "digest",
@@ -1815,15 +1825,15 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.38.25"
+version = "0.38.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc99bc2d4f1fed22595588a013687477aedf3cdcfb26558c559edb67b4d9b22e"
+checksum = "9470c4bf8246c8daf25f9598dca807fb6510347b1e1cfa55749113850c79d88a"
 dependencies = [
  "bitflags 2.4.1",
  "errno",
  "libc",
- "linux-raw-sys 0.4.11",
- "windows-sys 0.48.0",
+ "linux-raw-sys 0.4.12",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -2055,9 +2065,9 @@ dependencies = [
 
 [[package]]
 name = "spki"
-version = "0.7.2"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d1e996ef02c474957d681f1b05213dfb0abab947b446a62d37770b23500184a"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
 dependencies = [
  "base64ct",
  "der",
@@ -2324,9 +2334,9 @@ dependencies = [
 
 [[package]]
 name = "systemd-run"
-version = "0.5.0"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "949128fae310b7f643c55c651f4dc52d992bd934b9cc474ab0fc03cc0778f003"
+checksum = "97778e6c9df6214bb9de9ce662036b492f14d85b943ac48eb35905a0a8564ea2"
 dependencies = [
  "byte-unit",
  "futures",
@@ -2345,7 +2355,7 @@ dependencies = [
  "cfg-if",
  "fastrand 2.0.1",
  "redox_syscall",
- "rustix 0.38.25",
+ "rustix 0.38.26",
  "windows-sys 0.48.0",
 ]
 
@@ -2638,9 +2648,9 @@ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.88"
+version = "0.2.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7daec296f25a1bae309c0cd5c29c4b260e510e6d813c286b19eaadf409d40fce"
+checksum = "0ed0d4f68a3015cc185aff4db9506a015f4b96f95303897bfa23f846db54064e"
 dependencies = [
  "cfg-if",
  "wasm-bindgen-macro",
@@ -2648,9 +2658,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.88"
+version = "0.2.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e397f4664c0e4e428e8313a469aaa58310d302159845980fd23b0f22a847f217"
+checksum = "1b56f625e64f3a1084ded111c4d5f477df9f8c92df113852fa5a374dbda78826"
 dependencies = [
  "bumpalo",
  "log",
@@ -2663,9 +2673,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.38"
+version = "0.4.39"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9afec9963e3d0994cac82455b2b3502b81a7f40f9a0d32181f7528d9f4b43e02"
+checksum = "ac36a15a220124ac510204aec1c3e5db8a22ab06fd6706d881dc6149f8ed9a12"
 dependencies = [
  "cfg-if",
  "js-sys",
@@ -2675,9 +2685,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.88"
+version = "0.2.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5961017b3b08ad5f3fe39f1e79877f8ee7c23c5e5fd5eb80de95abc41f1f16b2"
+checksum = "0162dbf37223cd2afce98f3d0785506dcb8d266223983e4b5b525859e6e182b2"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -2685,9 +2695,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.88"
+version = "0.2.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c5353b8dab669f5e10f5bd76df26a9360c748f054f862ff5f3f8aae0c7fb3907"
+checksum = "f0eb82fcb7930ae6219a7ecfd55b217f5f0893484b7a13022ebb2b2bf20b5283"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2698,15 +2708,15 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.88"
+version = "0.2.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d046c5d029ba91a1ed14da14dca44b68bf2f124cfbaf741c54151fdb3e0750b"
+checksum = "7ab9b36309365056cd639da3134bf87fa8f3d86008abf99e612384a6eecd459f"
 
 [[package]]
 name = "web-sys"
-version = "0.3.65"
+version = "0.3.66"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5db499c5f66323272151db0e666cd34f78617522fb0c1604d31a27c50c206a85"
+checksum = "50c24a44ec86bb68fbecd1b3efed7e85ea5621b39b35ef2766b66cd984f8010f"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -2896,7 +2906,7 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2769203cd13a0c6015d515be729c526d041e9cf2c0cc478d57faee85f40c6dcd"
 dependencies = [
- "nix",
+ "nix 0.26.4",
  "winapi",
 ]
 
@@ -2933,7 +2943,7 @@ dependencies = [
  "futures-sink",
  "futures-util",
  "hex",
- "nix",
+ "nix 0.26.4",
  "once_cell",
  "ordered-stream",
  "rand",
@@ -2977,18 +2987,18 @@ dependencies = [
 
 [[package]]
 name = "zerocopy"
-version = "0.7.26"
+version = "0.7.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e97e415490559a91254a2979b4829267a57d2fcd741a98eee8b722fb57289aa0"
+checksum = "7d6f15f7ade05d2a4935e34a457b936c23dc70a05cc1d97133dc99e7a3fe0f0e"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.7.26"
+version = "0.7.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd7e48ccf166952882ca8bd778a43502c64f33bf94c12ebe2a7f08e5a0f6689f"
+checksum = "dbbad221e3f78500350ecbd7dfa4e63ef945c05f4c61cb7f4d3f84cd0bba649b"
 dependencies = [
  "proc-macro2",
  "quote",
diff --git a/Cargo.toml b/Cargo.toml
index f8934a4..902d1a1 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -28,5 +28,5 @@ optional = true
 hustoj = ["dep:sqlx"]
 
 [dependencies.systemd-run]
-version = "0.5.0"
+version = "0.6.0"
 features = [ "systemd_249", "unified_cgroup" ]
diff --git a/etc/systemd/system/opoj-empty-ns@.service b/etc/systemd/system/opoj-empty-ns@.service
new file mode 100644
index 0000000..c088696
--- /dev/null
+++ b/etc/systemd/system/opoj-empty-ns@.service
@@ -0,0 +1,11 @@
+# This file need to be copied to
+# opoj-empty-ns-0.service, opoj-empty-ns-1.service, ... for each
+# possible runner_id and adjusted.
+
+[Unit]
+Description=Empty namespace holder (runner %I)
+
+[Service]
+ExecStart=/bin/sleep infinity
+PrivateIPC=true
+PrivateNetwork=true
diff --git a/etc/systemd/system/opoj-x.slice b/etc/systemd/system/opoj-x.slice
index e5ce455..dafdc94 100644
--- a/etc/systemd/system/opoj-x.slice
+++ b/etc/systemd/system/opoj-x.slice
@@ -16,6 +16,7 @@
 
 [Unit]
 Description=Slice for OJ (runner X)
+Requires=opoj-empty-ns@X.service
 
 [Slice]
 # Normally we expect solutions judged with one CPU core.
diff --git a/mocktest/code/aplusb/net.py b/mocktest/code/aplusb/net.py
new file mode 100644
index 0000000..b0fea3d
--- /dev/null
+++ b/mocktest/code/aplusb/net.py
@@ -0,0 +1,10 @@
+from urllib.request import urlopen
+
+urlopen("https://acm.xidian.edu.cn/")
+
+try:
+    while True:
+        a, b = map(int, input().split())
+        print(a + b)
+except EOFError:
+    pass
diff --git a/mocktest/etc/judge3.toml b/mocktest/etc/judge3.toml
index 876971b..c00e528 100644
--- a/mocktest/etc/judge3.toml
+++ b/mocktest/etc/judge3.toml
@@ -56,6 +56,11 @@ src_name = "main.cc"
 cmd_compile = ["/usr/bin/g++", "main.cc", "-o", "main", "-fmax-errors=256"]
 cmd_run = ["/tmp/main"]
 
+[language."python"]
+src_name = "main.py"
+cmd_compile = ["/usr/bin/python3", "-m", "py_compile", "main.py"]
+cmd_run = ["/usr/bin/python3", "/tmp/main.py"]
+
 # An example for HustOJ configuration.
 #[hust]
 #db_url = "mysql://user:passwd@localhost/jol?socket=/run/mysqld/mysqld.sock"
diff --git a/mocktest/test19.toml b/mocktest/test19.toml
new file mode 100644
index 0000000..66daf4f
--- /dev/null
+++ b/mocktest/test19.toml
@@ -0,0 +1,6 @@
+language = "python"
+time_limit = 1
+memory_limit = "256 MiB"
+testcase_dir = "problem/aplusb"
+src = "code/aplusb/net.py"
+expect = "RunError"
diff --git a/mocktest/test_run.sh b/mocktest/test_run.sh
index 1a52b28..dc16076 100755
--- a/mocktest/test_run.sh
+++ b/mocktest/test_run.sh
@@ -8,16 +8,23 @@ mkdir -p output
 
 sudo install -v -d -m755 /run/systemd/system
 cat << EOF | sudo tee /run/systemd/system/opoj-42.slice > /dev/null
+[Unit]
+Requires=opoj-empty-ns@42.service
+
 [Slice]
 CPUQuota=100%
 AllowedCPUs=0
 TasksMax=32
 EOF
 
-sudo systemctl stop opoj-42.slice
+sudo cp ../etc/systemd/system/opoj-empty-ns@.service /run/systemd/system/
+
 sudo systemctl daemon-reload
 
-for i in {1..18}; do
+sudo systemctl stop opoj-42.slice
+sudo systemctl stop opoj-empty-ns@42.service
+
+for i in {1..19}; do
 	sudo ../target/debug/judge-client-3 test$i 42 .
 done
 
diff --git a/src/main.rs b/src/main.rs
index 097a212..afe5dcb 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -253,16 +253,15 @@ async fn run<P1: AsRef<Path>, P2: AsRef<Path>>(
         tmp = tmp.writable();
     }
 
-    let slice = cli
+    let prefix = cli
         .cfg
         .slice
         .as_deref()
         .or(etc.config.slice.as_deref())
-        .unwrap_or("opoj")
-        .to_owned()
-        + "-"
-        + &cli.runner_id
-        + ".slice";
+        .unwrap_or("opoj");
+
+    let slice = prefix.to_owned() + "-" + &cli.runner_id + ".slice";
+    let ns = prefix.to_owned() + "-empty-ns@" + &cli.runner_id + ".service";
 
     let service_name = [
         "opoj-runner",
@@ -289,6 +288,7 @@ async fn run<P1: AsRef<Path>, P2: AsRef<Path>>(
         .memory_swap_max(Byte::from_u64(0))
         .private_network()
         .private_ipc()
+        .joins_namespace_of(ns)
         .mount("/", systemd_run::Mount::bind(u8p(&root)?))
         .mount("/tmp", tmp)
         .mount_api_vfs()