How to use ss in specific network namespace

A more generic way is to use nsenter(1).

nsenter -t ${PID_FOO} -muni ss -tpi

A go to approach is using something like the following, when needing to run adhoc stuff, that do not necessarily have support for unshare(2)/setns(2) built-in.

docker run -it --rm --security-opt=seccomp:unconfined \
                    --security-opt=apparmor:unconfined \
                    --privileged --pid=host --userns=host \
debian:jessie@sha256:51cd80bb935b76fbbf49640750736abc63ab7084d5331e198326b20063e7f13c \
nsenter -t ${PID_FOO} -m -u -n -i -F ss -tpi