Linux by default allows unprivileged processes to create user namespaces, without needing root [0] ("Since Linux 3.8, unprivileged processes can create user namespaces, and the other types of namespaces can be created with just the CAP_SYS_ADMIN capability in the caller's user namespace."), and then create mounts, adjust the filesystem root, etc. within those unprivileged namespaces.
It's only in recent years that it's become trendy for distros to disable unprivileged user namespaces in the name of reducing kernel attack surface. So while a privileged daemon is needed for those distros, there is no such inherent restirction on the kernel level.
It's only in recent years that it's become trendy for distros to disable unprivileged user namespaces in the name of reducing kernel attack surface. So while a privileged daemon is needed for those distros, there is no such inherent restirction on the kernel level.
[0] https://man7.org/linux/man-pages/man7/user_namespaces.7.html