Thanks! Left a few comments.

Thanks for the changes so far. All asserts in a ns.Do() will need to be moved out ('need' as in 'hard to debug when things do start failing'). From looking at a few snippets of test code, there's a lot of:

ns.Do(func() error {
	ctl := sysctl.NewDirectSysctl(afero.NewOsFs(), "/proc")
	hostLink, peerLink, err := setupVethPair(log, tt.cfg, ctl)

... asserts and open-coded netlink calls ...
}

You have a few options to improve this:

• Make setupVethPair and friends take an (optional?) netlink.Handle, but this will involve some refactoring, and may not make work due to also managing sysctls there.
• Pass a netns.NetNS to the functions under test, but I'd consider that strictly worse than the netlink.Handle option.
• Multiple ns.Do() blocks in tests, but this will get messy and invites bugs with variable shadowing.
• My preferred option: call safenetlink.NewHandle() at the end of ns.Do() and use the handle in the outer test scope to interact with the netlink socket in the netns from the host netns. Haven't read all the test code in detail to know if this makes sense in all cases, but applies pretty broadly. I prioritize minimizing the amount of code within a ns.Do() to make bugs/mistakes as obvious as possible, even if it means refactoring, but use your own judgement ofc.

This would turn the above into:

var h *netlink.Handle
require.NoError(t, ns.Do(func() error {
	ctl := sysctl.NewDirectSysctl(afero.NewOsFs(), "/proc")
	hostLink, peerLink, err := setupVethPair(log, tt.cfg, ctl)
	if err != nil {
		return fmt.Errorf("setting up veth pair: %w", err)
	}

	h, err = safenetlink.NewHandle(nil)
	if err != nil {
		return err
	}
})

hl1,err := h.LinkByName(...)
assert.True(
... etc. ...

Thanks!

lgtm, thank you!