user_namespaces lists in Capabilities section the filesystems that can
be mount:
Holding CAP_SYS_ADMIN within the user namespace that owns a process's
mount namespace allows that process to create bind mounts and mount the
following types of filesystems:
* /proc (since Linux 3.8)
* /sys (since Linux 3.8)
* devpts (since Linux 3.9)
* tmpfs(5) (since Linux 3.9)
* ramfs (since Linux 3.9)
* mqueue (since Linux 3.9)
* bpf (since Linux 4.4)
IUUC this list should add
* overlay (since Linux 5.11)
