[ecs/lambda/fargate] [request]: Allow unprivileged containers to create new user namespaces with clone(2) and unshare(2)

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**

I'd like to create new unprivileged [user namespace](https://man7.org/linux/man-pages/man7/user_namespaces.7.html) so I could use [clone(2)](https://man7.org/linux/man-pages/man2/clone.2.html) to create sandboxed processes like [nsjail](https://github.com/google/nsjail), [bubblewrap](https://github.com/containers/bubblewrap), [isolate](https://github.com/ioi/isolate) or even how [Chromium does it](https://chromium.googlesource.com/chromium/src/+/main/docs/linux/sandboxing.md#User-namespaces-sandbox).

Since Linux 3.8 it should possible to create them without any extra permissions. From the [CLONE_NEWUSER section of the clone(2) man page](https://man7.org/linux/man-pages/man2/clone.2.html):

> Before Linux 3.8, use of CLONE_NEWUSER required that the caller have three capabilities: CAP_SYS_ADMIN, CAP_SETUID, and CAP_SETGID. **Starting with Linux 3.8, no privileges are needed to create a user namespace.**

Linux 3.8 was released in 2013 so I think it is pretty safe to assume that AWS is running newer kernels ;)

But when I try to create new user namespace with clone(2) it errors with `EPERM`. Tried this is in unprivileged ECS container and in a Lambda Container. The same code ran fine in a local linux installation when executed as non-root.

**Which service(s) is this request for?**

All container services: Lambda Containers, unprivileged ECS, Fargate etc.

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**

To run sandboxed processes which have no network access, does not see other process PIDs and have limited filesystem visibility.

**Are you currently working around this issue?**

I think I need to use privileged ECS containers. Have not tried them yet.

**Additional context**

Normally when a new user namespace is created with CLONE_NEWUSER it is possible to create bind mounts, use pivot root etc. without any extra permissions.

This could also allow running [rootless Docker](https://docs.docker.com/engine/security/rootless/) or [Podman](https://podman.io/) without privileged containers.

There is a great article series on Linux Namespaces on lwm.net: https://lwn.net/Articles/531114/

Start by reproducing the EPERM behavior with clone(2) or unshare(2) in an unprivileged ECS or Lambda container, then compare it with local Linux. Use the linked Linux namespace and syscall documentation to assess the request; done means unprivileged containers can create the requested user namespaces across the listed container services.

Written by the indexing model from the issue text.