re-add userns

[YtvwlD]

I disabled userns support in 447f548 for the initial rollout.
We should probably re-enable it (and extend it) to better isolate containers from the host.

Problems here: We need to redeploy everything and the paths change.