FWIW user namespacing is already available in docker experimental and will hopefully be getting into mainstream soon...