@lanodan @quad
AFAIU if there is a vulnerability in iptables, then in most cases, enabling unprivileged userNS will allow any user to exploit it, whether you have docker or bwrap installed or not.
So I'm guessing bwrap uses userNS but only as a privileged user (it has suid, right?) so that you can disable unprivileged userNS system-wide?