This is my take on a systemd#2741 work-around. The lack of native namespace joining makes it so you have to do a dance with systemd's
version of private namespaces and iproute2's version. The portal_network.sh
is my rendition of iproute2.
Credit to ian-kelling's code and comment in the systemd issue that inspired me to research this further.
Looking at iproute2's source the bash script should be identical, including the private mount and bind mounts. This level of compatibility
gives the administrator the ability to use ip -n portal ...
for any subsequent commands.
Files are dash separated due to this being a gist (slashes aren't allowed). PLace the files in the correct locations then run the following:
systemctl enable portal.target portal.network.service whatever.service
systemctl restart systemd-networkd
# if using the vlan files and such