My call to unshare(CLONE_NEWUSER) when called as a non-root user returns EPERM because of this (http://man7.org/linux/man-pages/man2/unshare.2.html):
EPERM (since Linux 3.9) CLONE_NEWUSER was specified in flags and the caller is in a chroot environment (i.e., the caller's root directory does not match the root directory of the mount namespace in which it resides).
I've used pivot_root(2) (at that time, running as root) rather than chroot(2) to get into this directory. I'verified that skipping the pivot_root(2) call makes unshare(CLONE_NEWUSER) succeed as a non-root user. But I want both: pivot_root(2) and unshare(CLONE_NEWUSER). I've tried adding unshare(CLONE_NEWNS) just after the pivot_root(2), but that didn't work, I'm still getting EPERM from unshare(CLONE_NEWNS). How can I make it succeed?
FYI I need this because I want to create a rootless container manually inside a chroot-like environment.