Tl: dr: escaping a namespace + setfsuid filesystem sandbox by creating an inner namespace with a weird UID mapping.

Please see the linked gist for details.

Original writeup (https://gist.github.com/badicsalex/bb90081031fed614b5ce51b0914b3550).