Idmap behavior when setting unisolated and isolated containers

Yeah, having security.idmap.size still apply to non-isolated would be fine.
Feel free to file a feature request for that.