Question: buildkit rootless + AppArmor on k8s- could Kubernetes UserNamespacesStatelessPodsSupport feature (v1.25 alpha) make this possible? #4022

I am experimenting in the hopes of using rootless buildkit as a container builder in a Kubernetes cluster (specifically GKE Sandbox) that is secured in such a way that AppArmor must be enabled. It is documented that rootless buildkit requires disabling the default AppArmor profile (snippet below):

      annotations:
        container.apparmor.security.beta.kubernetes.io/buildkit: unconfined

When I attempt to run buildkit w/o this annotation (w/ an AppArmor profile) I see the following error (WAI from the docs, just adding the error message for future context):

$ kubectl logs buildkit-non-root-syncthing-v2
Defaulted container "buildkit" out of: buildkit, prepare (init)
could not connect to unix:///run/user/1000/buildkit/buildkitd.sock after 10 trials
========== log ==========
[rootlesskit:parent] error: failed to setup UID/GID map: newuidmap 11 [0 1000 1 1 100000 65536] failed: newuidmap: Could not set caps
: exit status 1
sh: can't kill pid 4: No such process

I was wondering if anyone here might be able to weigh in on if the new-ish Kubernetes alpha feature - UserNamespacesStatelessPodsSupport might be able to be used instead of newuidmap to get buildkit rootless working w/ AppArmor on k8s? I am not sure what the full set of capabilities buildkit rootless requires is but was wondering if anyone might know if theoretically using this feature and modifying buildkit rootless could provide a solution here? Happy to help explore this as well, currently having some issues getting the alpha UserNamespacesStatelessPodsSupport feature working for me in a kubernetes cluster. Thanks!