User namespace mappings not working as expected

The spec here shows that the config.json uidMappings and gidMappings should forward {u,g}ids from the host into the container runtime.

Its very possible I'm misunderstanding intended behavior here but I'm not able to map a user ID from the host into an existing user ID in the container using runc.

I'm more convinced this is a bug as I'm able to run the exact same config.json file with virtually the same arguments to crun and it works as expected.

I've been pouring over issues and a lot sound tangentially related but all seem like they may be trying to accomplish something slightly different than my case.

I would like to try to set up as minimally reproducible environment as possible, but I'm not sure the most effective way to do that. Open to suggestions!

Some more info about my environment (happy to provide more as necessary):

Tools

$ crun --version
crun version 1.0
commit: 139dc6971e2f1d931af520188763e984d6cdfbf8
spec: 1.0.0
+SELINUX +APPARMOR +CAP +SECCOMP +EBPF +YAJL

$ runc --version
runc version 1.0.2
commit: 52b36a2dd837e8462de8e01458bf02cf9eea47dd
spec: 1.0.2-dev
go: go1.16.7
libseccomp: 2.5.1

Relevant Output

$ runc run -b my-container-path/ my-container
ERRO[0000] User namespaces enabled, but no user mapping found.

$ crun run -b my-container-path/ my-container
/ $ exit

^^^ Note the above showing the $ character for prompt; I've not included it but confirmed id reports back with app(1000) et cetera.

Host

• OS: alpine (Raspberry Pi sys install)
• Users:
  • nathan:1000:1000

Container

• OS: alpine:3
• Users:
  • app:1000:1000

Relevant lines from config.json

"user": {
	"uid": 1000,
	"gid": 1000
},

...

"uidMappings": [
	{
		"containerID": 1000,
		"hostID": 1000,
		"size": 1
	}
],
"gidMappings": [
	{
		"containerID": 1000,
		"hostID": 1000,
		"size": 1
	}
],

Start by reproducing the reported runc run -b failure with the supplied config.json, host/container IDs, and version details. Compare the result with the equivalent crun invocation and inspect how the user namespace mappings are interpreted when the User section requests UID and GID 1000. Done means establishing whether the behavior violates the referenced OCI mapping specification and documenting a focused fix or reproducible test.