All Systems Go! 2025

Unprivileged Containers, with Transient User Namespaces and ID Mapping, but Without SETUID Binaries
2025-10-01 , Main

Many traditional container engines make use of the "subuid" concept and the "newuidmap" tool to implement a concept of "unprivileged" user-namespace containers on Linux. This approach has many shortcomings in my PoV, from both a security and scalability standpoint.

Recent systemd versions provide a more powerful, more secure, mor scalable alternative, via systemd-nsresourced, systemd-mountfsd and other components.

In this talk I want to shed some light on the problems with the "old ways", and in particular focus on what the "new ways" bring to the table, and how to make use of them in container runtimes.

Lennart hacks on systemd.

This speaker also appears in: