I wonder if there is a way to stop creating other threads?

No, there is no way.

can not use unshare(CLONE_NEWUSER) syscall.

Why?

Go programs are always multi-threaded. unshare(CLONE_NEWUSER) is defined to only work if the program is not multi-threaded. I don't see any way to call it in a Go program. You will have to write a wrapper, perhaps using the /usr/bin/unshare command.

See also #1954.

If you want to use unshare, one way is to call it inside a constructor
where the process is still single threaded.

/*
attribute((constructor)) void enter_ns(void) {
// call unshare here
}
*/
import "C"

@minux thanks for your reply.
And may I use flag package in this function , just like " flag.NArg()" and "flag.Arg(1)" ??

If no, how to handle argument of the program in this early phase?

@minux thanks a lot.