You can map the root /proc into a container, and then use that to
re-enter the root mount namespace with nsenter:
-bash-4.2# mount|grep test
-bash-4.2# docker run --privileged --rm -ti -v /proc:/sysproc fedora bash
[root f8fe3faaf4e1 /]# nsenter --mount=/sysproc/1/ns/mnt -- mount -t tmpfs tmpfs /var/mnt/test
[root f8fe3faaf4e1 /]# exit
-bash-4.2# mount|grep test
tmpfs on /var/mnt/test type tmpfs (rw,relatime,seclabel)
-bash-4.2#
Hmm that did work :) I thought I tried it and got and a permission denied, but I must have missed something.