little warning for others - i tested it on a jammy box with kernel.unprivileged_userns_clone = 0 and it froze up good