fix: use rootless umoci inside user namespace

If we are running from within a user namespace, then use rootless OCI
layer with umoci.

This permits the extraction to complete when singularity is run under
`unshare -r`.

Part of sylabs#2698

CHANGELOG.md

@@ -19,6 +19,8 @@
   the original image.
 - Fix `target: no such file or directory` error in native mode when extracting
   layers from certain OCI images that manipulate hard links across layers.
+- Fix extraction of OCI layers when run in a root mapped user namespace 
+  (e.g.. `unshare -r`).
 
 ## 4.1.1 \[2024-02-01\]
 

internal/pkg/ociimage/unpack.go

@@ -16,7 +16,9 @@ import (
 	umocilayer "github.com/opencontainers/umoci/oci/layer"
 	"github.com/opencontainers/umoci/pkg/idtools"
 	"github.com/sylabs/singularity/v4/internal/pkg/util/fs"
+	"github.com/sylabs/singularity/v4/pkg/util/namespaces"
 	"github.com/sylabs/singularity/v4/pkg/sylog"
+
 )
 
 // isExtractable checks if we have extractable layers in the image. Shouldn't be
@@ -69,7 +71,8 @@ func UnpackRootfs(_ context.Context, srcImage v1.Image, destDir string) (err err
 	}
 
 	// Allow unpacking as non-root
-	if os.Geteuid() != 0 {
+	insideUserNs, _ := namespaces.IsInsideUserNamespace(os.Getpid())
+	if os.Geteuid() != 0 || insideUserNs {
 		mapOptions.Rootless = true
 
 		uidMap, err := idtools.ParseMapping(fmt.Sprintf("0:%d:1", os.Geteuid()))