As of Libnetwork 0.4 / Docker 1.8, libnetwork creates and owns the container's network namespace. The network resources are later pushed into the namespace and returned to the caller (Docker Daemon).
Since the namespace is entirely managed by libnetwork, the concept of Sandbox was an implementation detail within.
In order to support the User namespace requirement, as seen in moby/moby#15187, we end up in a fundamental change in the design, summarized as follows

1. Expose CNM's Sandbox object through APIs
2. Separate endpoint and sandbox (container) configs & lifecycle cleanly
3. Redesign the current endpoint join operation as a 2 step process
   • Allocate Network resources based on container configurations.
   • Wait on a Namespace creation call from the Daemon and apply the allocated network resources to the namespace.

We will open smaller PRs to address these changes in incremental fashion.