Unprivileged mount namespaces are not available in Ubuntu VM #2638

Describe the bug

I'm using Ubuntu 22.04 and 26.04 (too) inside an OrbStack VM. I noticed that unprivileged mount namespaces are not available.

The following command works:
unshare --user --map-root-user id

However:
unshare --mount

returns:
unshare: unshare failed: Operation not permitted

Running the same command with sudo succeeds. This causes Cursor IDE Terminal Sandbox to fail during initialization.
The Cursor team investigated this and confirmed that the sandbox cannot start because unprivileged mount namespaces are unavailable in this environment.

Environment:

• Host: macOS 26.6 (Apple Silicon)
• OrbStack Version 2.2.2 (20903)
• Guest: Ubuntu 22.04
• Kernel: Linux 7.0.14-orbstack

Kernel configuration:

• CONFIG_BPF_LSM=y
• CONFIG_NAMESPACES=y
• CONFIG_USER_NS=y
• CONFIG_SECCOMP=y
• CONFIG_SECCOMP_FILTER=y
• CONFIG_SECURITY_LANDLOCK=y

AppArmor is not present:

• $ aa-status
• apparmor not present

To Reproduce

1. Create an Ubuntu 22.04 VM in OrbStack.

2. Open a terminal.

3. Run:
   unshare --user --map-root-user id
   This succeeds.

4. Run:
   unshare --mount
   Result:
   unshare: unshare failed: Operation not permitted

5. Run:
   sudo unshare --mount true
   This succeeds.

Expected behavior

I would like to know whether this is expected behavior.
If so:

• Is blocking unprivileged mount namespaces an intentional limitation?
• Is there a configuration option to enable them?
• Is support for them planned in a future OrbStack release?
  This affects applications that rely on unprivileged mount namespaces, such as Cursor IDE Terminal Sandbox.

Diagnostic report (REQUIRED)

No response

Screenshots and additional context (optional)

No response