In later versions of util-linux,
unshare gained the
--map-root-user option. Quoting from
unshare(1) version 2.26.2:
Run the program only after the current effective user and group IDs have been mapped to the superuser UID and GID in the newly created user namespace. This makes it possible to conveniently gain capabilities needed to manage various aspects of the newly created namespaces (such as configuring interfaces in the network namespace or mounting filesystems in the mount namespace) even when run unprivileged. As a mere convenience feature, it does not support more sophisticated use cases, such as mapping multiple ranges of UIDs and GIDs. This option implies --setgroups=deny.
So, on newer systems, you can run:
unshare -n -r ping 127.0.0.1
And this will yield the expected
Network is unreachable.