I was reading up on rootless containers which have the possibility to have unprivileged non-root containers where the parent process or tool that starts the application container itself runs as "non-root". In this regard, I chanced upon Firejail. However, the documentation of Firejail mentions that their method of achieving rootless container is by SUID (setuid) where the firejail tool is an suid binary , gets elevated privileges and spawns an application container with user privileges. How does this compare to a user namespace?

From other tools like runC I somehow had the feeling that user namespace is all that one needs to realize a rootless container. Am I right?

Can someone throw some light?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.