Cannot enter namespace in Singularity container with --fakeroot

[Heng-Zhou]

This is the minimum definition file of the Singularity container, named test.def:

BootStrap: library
From: ubuntu

%post
    set -xe
    apt-get -y update && apt -y upgrade
    apt install -y nano less
    apt install -yqq daemonize dbus-user-session fontconfig

%environment
    export LC_ALL=C

I have set up fakeroot and user ID mappings. So after the container test.sif is generated, I shell into it as a fakeroot:

singularity shell --fakeroot --userns --writable-tmpfs test.sif

The command cat /proc/$$/uid_map returns the following results in the container, which I believe indicates that the fakeroot settings are correct (my user ID on the host outside container is 1084):

Next I create a new mnt, user and pid namespace, and make it stay in memory:

daemonize /bin/unshare -Urpf --mount-proc bash -c 'exec /lib/systemd/systemd --unit=basic.target'

There is no error from this command.

Then I tried to find out the PID of systemd --unit=basic.target using lsns |grep systemd command; assume it is 2331224. Finally, I tried to enter the namespaces associated with this process:

nsenter -t 2331224 -a

However, I got an error:

nsenter requires sudo privilege to run, but I am a fakeroot, so I should have the needed permission to enter the namespace of systemd. Can you please help me fix this issue? My expectation is that nsenter can enter all (or at least the mnt, user and pid) namespaces in Singularity container without errors, and the process systemd --unit=basic.target shows up in the ps list with PID=1, which is the case on a normal Ubuntu (i.e., non-containerized). Thanks.

[Heng-Zhou]

Solved myself.
The order of namespaces matters. If using command nsenter --preserve-credentials --user --mount --pid -t 2331224, I can enter the namespaces without error, and see the systemd --unit=basic.target as PID=1.