When you start a commercial VPN client, it brutally hijacks your entire routing table. If you only want to route one specific application through the tunnel while leaving your host untouched, you don’t need a virtual machine – you just need a Linux network namespace.
