Boosting Container Security with Rootless Containers

**Executive summary:** Running containers as root by default increases the risk of host compromise because container root maps to host root; rootless containers mitigate this by using user namespaces so processes appear as root inside the container while mapping to unprivileged host IDs, reducing the attack surface. The post describes how rootless implementations work, notes vendor support (podman, Singularity, Docker rootless), mentions ongoing Kubernetes work, and recommends avoiding root containers and using admission controls, policy checks, and configuration scanning to enforce non-root container execution.