It’s also a bit of a layering violation, and would require either a suid root binary to be available inside the container to de-chroot and de-namespace, or a constantly running daemon outside the container (again as root) ready to rebuild when asked. And I certainly don’t trust myself to avoid writing a confused deputy vulnerability.