There's at least one problem remaining: rename/unlink returns EBUSY for mountpoint regardless of which mnt_namespace the mount is in. It's solvable, e.g. by allowing unlink to detach these kinds of mounts, but I haven't gotten around to doing it yet.