user-id mapping, or running bwrap as a different user

Hello,

I'm interested in using bubblewrap to run a long-term daemon, as a separate user.

first,
is this an intended use-case ? or is bubblwrap mainly intended to sandbox an application for an active user (e.g. logged-in interactive user running a sandbox unsafe application) ?

second,
If it is supported, what would be a recommended way to run bwrap with user-id mapping ?
The `--uid/--gid` map ID inside the container, but the real user is still the user which invoked bwrap.

I can use `sudo -u www-data bwrap [...]` , but that seems a bit ugly as it will be `www-data` who runs the bwrap binary (and if using sudo, then why does bwrap needs to be setuid in the first place?)

thanks in advance for any advice,
-assaf