Which kernel feature lets rootless Podman map container root to an unprivileged user?

Question

Accepted Answer

User namespaces — they remap container UIDs onto the host's unprivileged range — User namespaces remap the container's UIDs (including root) to unprivileged host UIDs, enabling rootless mode. cgroups limit resources, seccomp filters syscalls, and capabilities split root's powers — useful, but none provides the UID remapping rootless relies on.

Answer

Control groups — they cap the CPU and memory a container is allowed to consume

Answer

Seccomp filters — they restrict which system calls a container may invoke

Answer

Capabilities — they split root's powers into individually grantable privileges

Which kernel feature lets rootless Podman map container root to an unprivileged user?

Why this is the answer

More Podman Fundamentals flashcards