use docker namespace

class { 'docker':
  extra_parameters => ['--userns-remap=default'],
}

This permits to enable namespace.

To check namespace is used, in a container :

$> cat /proc/$$/uid_map
0 165536 65536

Without namespace enabled, in a container :

$> cat /proc/$$/uid_map
0 0 429496536

(0+0) means UID 0 root in container, is same UID 0 root on host.