The osg singularity install documentation includes instructions for running unprivileged singularity under docker. I have tested it on my development VM, but it has not been tested in production and it should be. UNL is the most logical place to test it.
The latest version of singularity (3.6.1) is installed for unprivileged use in cvmfs at
The cms and osg VOs will automatically run the "current" version there instead of "3.6" when unprivileged user namespaces is enabled.