How to run rootless containers

**Executive Summary:** This guide explains the security risks of running containers as root and provides practical, actionable steps to run containers unprivileged: adapt images (e.g., change privileged ports, adjust file ownership and writable paths to /tmp, set PID locations), use Linux capabilities when needed, enable user namespaces to map container root to an unprivileged host user, and apply additional hardening such as read-only filesystems and multi-stage builds.