In this lesson, you will learn how user namespace mappings allow a process to act as the "root" user inside a container while remaining a regular, unprivileged user on your host system.
The Illusion of Identity
When you run a container, you often see a user identified as root (UID 0) inside that environment. However, if that root user actually held administrative power over your entire host, it would be a massive security vulnerability. Linux solves this using User Namespaces.
A user namespace provides a private mapping table. It allows the kernel to translate a UID inside the container to a completely different UID on the host. For example, the container's root (UID 0) might actually be mapped to a high-numbered, unprivileged user on your host (e.g., UID 100000).
How Mapping Works
The mapping is defined in the /proc/[pid]/uid_map and gid_map files. Each line in these files defines a range of IDs:
# Inside_UID Outside_UID Length
0 100000 65536
In this example, the container sees 65,536 IDs starting at 0. The kernel maps these to the range starting at 100,000 on the host. If a process inside the container creates a file owned by its root (UID 0), the Linux kernel translates that request so the file is actually owned by UID 100,000 on the host filesystem.
Why This Matters
This mapping ensures that even if a malicious actor breaks out of a container or tricks an application into executing code, they only possess the permissions of the unprivileged host user (UID 100,000). They have no capability to modify system files, access sensitive logs, or interfere with other containers, because the host kernel recognizes them as an identity with no special rights. By decoupling the "internal" identity from the "external" system reality, we enforce strict isolation while maintaining the convenience of familiar user management within the container environment.
Key Takeaway: UID/GID mapping translates container-internal privileges into safe, unprivileged identities on the host, preventing a container's "root" user from ever gaining actual administrative access to your system.