user namespace
also: userns
A Linux kernel feature that allows processes to have their own isolated view of user and group IDs, enabling unprivileged users to run containers or services with root-like capabilities within their namespace.
User namespaces are a kernel isolation mechanism that remaps user and group IDs. A process running in a user namespace can appear to have UID 0 (root) within that namespace, while actually running as an unprivileged user on the host system. This enables secure privilege separation without requiring true root access.
For example, a container runtime like Docker or Podman can use user namespaces so that a container process appears to run as root inside the container, but is actually mapped to a regular user account on the host. If the container is compromised, the attacker gains only the privileges of that unprivileged host user, not true root access.
User namespaces work by maintaining mappings between namespace IDs and host IDs. A simple mapping might allocate host UIDs 100000–165535 to a container, so UID 0 inside the container maps to UID 100000 on the host. This allows nested isolation and is essential for rootless container execution.