They mostly work by just implementing the functionality in userspace instead of using syscalls. No daemon needed.

That cannot be true. You need to tell the kernel about the namespaces, cgroups, and the new root. Otherwise it's not a container, and there is no reason or mechanism for a child proc to respect it. And if you let any old unprivileged process do this, you open up security problems.

	▲	80fj0348i an hour ago \| parent [-]
		I've done this for practical use cases, like running a container inside another container that didn't have root privileges. It works fine for that use case. I'm not worried about restricting access of the process because it's already within a larger sandbox, I'm usually just trying to execute the command within the child container's filesystem (e.g. some vendor/partner software they ship as a container image). I don't know why you're so shocked by this? This is all very basic use of the OCI spec.