User namespaces support based on graph driver-driven image mapping approach

Can you write the implementation for this? We just need to `CLONE_NEWUSER`, start the child program (all `UID`s and `GID`s at this point are essentially unmapped) then write to `/proc/PID/uid_map` and `/proc/PID/gid_map` (since we now know the `PID` of the child process). Speaking of which, why aren't we also including `GID` mappings, since group IDs are also part for the namespace.