Wouldn't you have the option of running the helper process within the mount namespace but not the process namespace of the container?

Regardless, openat2 looks like a much better solution. I hope it's backported to LTS distros so I can start relying on it before 2035...