I was reading up on rootless containers which have the possibility to have unprivileged non-root containers where the parent process or tool that starts the application container itself runs as "non-root". In this regard, I chanced upon Firejail. However, the documentation of Firejail mentions that their method of achieving rootless container is by SUID (setuid) where the firejail tool is an suid binary , gets elevated privileges and spawns an application container with user privileges. How does this compare to a user namespace?
From other tools like runC I somehow had the feeling that user namespace is all that one needs to realize a rootless container. Am I right?
Can someone throw some light?