I spent some time trying to get things running with minijail mapping a single UID but it's pretty unpleasant. The parent/child need another sync point, and I haven't yet gotten a way for the parent to assign the uid_map of the child after it enters its second namespace.

I think the parent will have to grab an fd for the child's namespace before it unshares again, then setns() so it will actually be able to write the inner uid_map.

Changing the title to make it clearer.