The key is user namespaces.  Unprivileged users can create containers easily via user namespaces.  Once the user creates a user namespace, they have root in that namespace and are free to unshare the rest of the namespaces.  This is how I wrote &#x27;guix environment --container&#x27;[0], a tool for creating isolated development environments using the GNU Guix package manager.  The big caveat is that unprivileged users do not setuid&#x2F;setgid capability, so the number of uids&#x2F;gids in the container is limited to 1, but I believe that even this is being dealt with in Linux now.<p>[0] <a href="https:&#x2F;&#x2F;gnu.org&#x2F;software&#x2F;guix&#x2F;manual&#x2F;html_node&#x2F;Invoking-guix-environment.html#Invoking-guix-environment" rel="nofollow">https:&#x2F;&#x2F;gnu.org&#x2F;software&#x2F;guix&#x2F;manual&#x2F;html_node&#x2F;Invoking-guix...</a>