Yea it’s user / mount namespace all the way.

At least root seems to not be mapper correctly (sudo is owned by nobody, as opposed to root)

see https://man7.org/linux/man-pages/man7/user_namespaces.7.html "In order for a process to write to the /proc/pid/uid_map ...", currently bullet 5, (b), bullet 1

The data written to uid_map (gid_map) must consist of a single line that maps the writing process's effective user ID (group ID) in the parent user namespace to a user ID (group ID) in the user namespace.

Sharing this from Spack (spack.io) how they handle OpenGL or runtime type library dependencies:

If a binary is built in a CI/CD pipeline at /opt/spack/build/... and you download it to /home/user/super_long_project_name/spack/..., Spack needs to rewrite the RPATH in the ELF binary.

The Problem: You can safely shrink a string in a compiled binary, but if you try to replace a string with a longer one, you will overwrite adjacent memory and corrupt the executable.

The Solution: Spack uses a configuration called padded_length (often set to 128 characters or more). During the initial build, Spack intentionally pads the installation path with extra characters. This forces the compiler to generate massive, padded RPATH strings in the binary.

When you download the binary cache, Spack's relocation logic strips out the padding and inserts your local, shorter path. Because the original string was artificially inflated, Spack always has enough room to rewrite the path without breaking the binary.