setuid wrapper for unprivileged chroot and namespace manipulation

 Core execution engine for unprivileged containers that works as a setuid
 binary on kernels without user namespaces.