the attached patch (in conjuction with  for linux 3.14.22, though possibly
still applicable to kernels < 3.14.19 without those additional patches)
allows linux 3.14 to compile and run with CONFIG_USER_NS, including
1. this is not production quality and only made available for testing.
2. i don't know the security ramifications of running both vservers and
containers on a single host.
3. it is conceivable that containers can run inside of vservers with the
provided patch, but i haven't tested such nor do i know the security
1. vservers will not use user namespaces by default. 
2. vservers cannot use user namespaces without changes to util-vserver and
possibly more kernel changes. 
3. lxc should work. 
 in the attached patch CLONE_NEWUSER is commented out in
default_space_mask which prevents util-vserver from using user namespaces with
 vspace needs to create uid and gid mappings for the new user namespace
between sys_clone() and execvp() calls otherwise all capabilities,
specifically CAP_CONTEXT, are removed from the executed vcontext because the
uid and gid are 65535. see https://lwn.net/Articles/532593/, specifically
the section "Capabilities, execve(), and user ID 0".
 tested with lxc 1.0.6 on linux 3.14.22-vs126.96.36.199 with the attached
userns patch by creating a container ("SUITE=wheezy
MIRROR=http://http.us.debian.org/debian lxc-create -n test -t debian"),
starting the container ("lxc-start -n test -d"), and attaching to the console
("lxc-console -n test"), and stopping the container ("lxc-stop -n test")
though i was unable to log into the container ("unable to determine your tty
name"), but i believe that to be a configuration problem with the
installation inside the container.
1. the last two hunks are not both necessary. commenting out CLONE_NEWUSER
in default_space_mask is used to keep util-vserver from using user namespaces
for vservers. changing "capable()" to "ns_capable()" is required to use
linux-vserver system calls within a user namespace (and is there currently
for testing as it's not that useful without the aforementioned changes to
util-vserver). you really only need one or the other and the last hunk is
not that useful without changes to util-vserver (and more changes might be
please test and provide feedback, especially if you have better suggestions to
simply test lxc/containers as i'm a newbie in that area.