userns with systemd as init

using this config file in current Ubuntu LTS

  "ociVersion": "1.0.1-dev",
  "process": {
    "terminal": false,
    "user": {
      "uid": 0,
      "gid": 0
    },
    "args": [
      "/sbin/init",
      "--system"
    ],
    "env": [
      "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
      "HOSTNAME=bionic",
      "CONTAINER=lxc",
      "INIT=/sbin/init"
    ],
    "cwd": "/",
    "capabilities": {
      "bounding": [
        "CAP_CHOWN",
        "CAP_DAC_OVERRIDE",
        "CAP_FSETID",
        "CAP_FOWNER",
        "CAP_MKNOD",
        "CAP_NET_RAW",
        "CAP_SETGID",
        "CAP_SETUID",
        "CAP_SETFCAP",
        "CAP_SETPCAP",
        "CAP_NET_BIND_SERVICE",
        "CAP_SYS_CHROOT",
        "CAP_KILL",
        "CAP_AUDIT_WRITE",
        "CAP_SYS_ADMIN"
      ],
      "effective": [
        "CAP_CHOWN",
        "CAP_DAC_OVERRIDE",
        "CAP_FSETID",
        "CAP_FOWNER",
        "CAP_MKNOD",
        "CAP_NET_RAW",
        "CAP_SETGID",
        "CAP_SETUID",
        "CAP_SETFCAP",
        "CAP_SETPCAP",
        "CAP_NET_BIND_SERVICE",
        "CAP_SYS_CHROOT",
        "CAP_KILL",
        "CAP_AUDIT_WRITE",
        "CAP_SYS_ADMIN"
      ],
      "inheritable": [
        "CAP_CHOWN",
        "CAP_DAC_OVERRIDE",
        "CAP_FSETID",
        "CAP_FOWNER",
        "CAP_MKNOD",
        "CAP_NET_RAW",
        "CAP_SETGID",
        "CAP_SETUID",
        "CAP_SETFCAP",
        "CAP_SETPCAP",
        "CAP_NET_BIND_SERVICE",
        "CAP_SYS_CHROOT",
        "CAP_KILL",
        "CAP_AUDIT_WRITE",
        "CAP_SYS_ADMIN"
      ],
      "permitted": [
        "CAP_CHOWN",
        "CAP_DAC_OVERRIDE",
        "CAP_FSETID",
        "CAP_FOWNER",
        "CAP_MKNOD",
        "CAP_NET_RAW",
        "CAP_SETGID",
        "CAP_SETUID",
        "CAP_SETFCAP",
        "CAP_SETPCAP",
        "CAP_NET_BIND_SERVICE",
        "CAP_SYS_CHROOT",
        "CAP_KILL",
        "CAP_AUDIT_WRITE",
        "CAP_SYS_ADMIN"
      ]
    },
    "rlimits": [
      {
        "type": "RLIMIT_NOFILE",
        "hard": 65536,
        "soft": 65536
      }
    ],
    "noNewPrivileges": false,
    "oomScoreAdj": 0
  },
  "root": {
    "path": "rootfs",
    "readonly": false
  },
  "hostname": "bionic",
  "mounts": [
    {
      "destination": "/proc",
      "type": "proc",
      "source": "proc",
      "options": []
    },
    {
      "destination": "/dev",
      "type": "tmpfs",
      "source": "tmpfs",
      "options": [
        "nosuid",
        "strictatime",
        "mode=755",
        "size=65536k"
      ]
    },
    {
      "destination": "/dev/pts",
      "type": "devpts",
      "source": "devpts",
      "options": [
        "nosuid",
        "noexec",
        "newinstance",
        "ptmxmode=0000",
        "mode=0620",
        "gid=5"
      ]
    },
    {
      "destination": "/dev/shm",
      "type": "tmpfs",
      "source": "tmpfs",
      "options": [
        "nosuid",
        "nodev",
        "rw"
      ]
    },
    {
      "destination": "/sys",
      "type": "sysfs",
      "source": "sysfs",
      "options": [
        "nosuid",
        "noexec",
        "nodev",
        "ro"
      ]
    },
    {
      "destination": "/dev/mqueue",
      "type": "mqueue",
      "source": "mqueue",
      "options": []
    },
    {
      "destination": "/tmp",
      "type": "tmpfs",
      "source": "tmpfs",
      "options": [
        "noexec",
        "nosuid",
        "nodev",
        "rprivate"
      ]
    },
    {
      "destination": "/run",
      "type": "tmpfs",
      "source": "tmpfs",
      "options": [
        "noexec",
        "nosuid"
      ]
    },
    {
      "destination": "/run/lock",
      "type": "tmpfs",
      "source": "tmpfs",
      "options": [
        "noexec",
        "nosuid",
        "nodev"
      ]
    },
    {
      "destination": "/run/user/1002",
      "type": "tmpfs",
      "source": "tmpfs",
      "options": [
        "nosuid",
        "nodev"
      ]
    },
    {
      "destination": "/sys/fs/cgroup",
      "type": "bind",
      "source": "/sys/fs/cgroup",
      "options": [
        "rbind",
        "ro",
        "rprivate",
        "nodev",
        "noexec",
        "nosuid"
      ]
    }
  ],
  "linux": {
    "uidMappings": [
      {
        "hostID": 131072,
        "containerID": 0,
        "size": 65536
      }
    ],
    "gidMappings": [
      {
        "hostID": 131072,
        "containerID": 0,
        "size": 65536
      }
    ],
    "resources": {
      "devices": [
        {
          "allow": false,
          "access": "rwm"
        }
      ],
      "memory": {
        "disableOOMKiller": false
      },
      "cpu": {
        "shares": 0
      },
      "pids": {
        "limit": 0
      },
      "blockIO": {
        "weight": 0
      }
    },
    "cgroupsPath": "system.slice:runc:bionic",
    "namespaces": [
      {
        "type": "mount"
      },
      {
        "type": "network"
      },
      {
        "type": "uts"
      },
      {
        "type": "pid"
      },
      {
        "type": "ipc"
      },
      {
        "type": "user"
      }
    ],
    "maskedPaths": [
      "/proc/acpi",
      "/proc/kcore",
      "/proc/keys",
      "/proc/latency_stats",
      "/proc/timer_list",
      "/proc/timer_stats",
      "/proc/sched_debug",
      "/proc/scsi",
      "/sys/firmware"
    ],
    "readonlyPaths": [
      "/proc/asound",
      "/proc/bus",
      "/proc/fs",
      "/proc/irq",
      "/proc/sys",
      "/proc/sysrq-trigger"
    ]
  }
}

gives error:
container_linux.go:344: starting container process caused "process_linux.go:424: container init caused \"rootfs_linux.go:46: preparing rootfs caused \\\"permission denied\\\"\""

but using same rootfs with systemd-nspawn work, container is started with shifted UIDs

would be nice to have some docs on how run properly run systemd inside runc with userns isolation.

Start by reviewing the OCI configuration and the startup error references to container_linux.go:344, process_linux.go:424, and rootfs_linux.go:46. Reproduce the failure with the provided user namespace mappings and compare it with the working systemd-nspawn setup. Done means documenting the required configuration and steps for running systemd as init under runc with user namespace isolation.