Just stumbled upon the same problem, it seems that CLONE_NEWUSER ( and as the consequence unprivileged containers ) simply doesn't work with grecurity patched kernel, see:
https://forums.grsecurity.net/viewtopic.php?f=3&t=3929 You can see if "user namespaces" works with this code: https://lwn.net/Articles/539941/
