fakeroot cdebootstrap: Failed to unshare: Operation not permitted

On Debian, when running: $ fakeroot cdebootstrap stable /tmp/foo cdebootstrap downloads the packages, but when it has to extract them, I get this error: E: Failed to unshare: Operation not permitted How can I run cdebootstrap as non-root? This part in unshare's manual seems relevant, but am not sure how: EPERM (since Linux 3.9) CLONE_NEWUSER was specified in flags and the caller is in a chroot environment (i.e., the caller's root directory does not match the root directory of the mount namespace in which it resides).