The main problem with user namespaces is file ownership. User namespaces allow you to shift a range of user ids to a different set of user ids on the host, but

The main problem with user namespaces is file ownership. User namespaces allow you to shift a range of user ids to a different set of user ids on the host, but there is no way to mount a filesystem with the same set of shifts. This means you have to copy the root filesystem for the container and chown it which is pretty hairy. Note that there have been various proposals to do some kind of shifting at the fs layer[1] but nothing has been finished yet. [1] http://lwn.net/Articles/637431/ http://lwn.net/Articles/637431/