kernel.unprivileged_userns_clone=0
because it breaks too much fixes https://github.com/Kicksecure/security-misc/issues/274
/usr/lib/issue.d/20_security-misc.issue