Oh, of course you're right. I implemented this stuff in gaol and completely forgot I had to stay as root inside the namespace because you can't setuid to unmapped users.

I stand (embarrassingly) corrected.