Wouldn't that also require full namespace support, not just "a couple extra kernel features"?

At that point if you want to bind mount in a container you're talking about macOS binaries running inside the container, which means a full macOS docker architecture port (like they did for Windows, which AFAICT didn't make them much if any money, but I think M$ paid for it anyway).