rootless container
also: unprivileged container, rootless mode
A container runtime that executes container processes without requiring root privileges on the host system, enhancing security by limiting what a compromised container can access.
A rootless container is a containerization approach where the container engine and all processes inside the container run under an unprivileged user account rather than as root. This means even if an attacker gains control inside the container, they cannot escalate to root privileges on the host system.
Traditional containers often run as root, which creates a security risk: a container escape could give an attacker full control of the host. Rootless containers mitigate this by using user namespaces and other kernel isolation features to map container processes to non-root UIDs on the host.
For example, with rootless Docker or Podman, you can run: podman run --rm alpine id and the process will show a non-zero UID, even though it appears as root (UID 0) inside the container. The host sees it as an unprivileged user, limiting damage if the container is compromised.