In this lesson, you will learn how to make an unprivileged user on your host machine appear as the "root" administrator inside a restricted process container.
The Problem of Privileged Containers
Normally, running a process as root is dangerous because if the process breaks out of its container, it has full control over your entire host system. However, many applications require root privileges (like binding to low-numbered network ports or changing ownership of files) to function correctly. User Namespaces solve this dilemma by decoupling the user's ID on the host from the user's ID inside the container.
How Mapping Works
When you create a User Namespace, you create a mapping between a range of IDs on your host and a range of IDs inside the namespace. For example, you can map your regular user account (e.g., UID 1000) to the "root" user (UID 0) inside the container.
When the process inside the container performs an action that requires root—like changing a file's permission—the kernel checks the User Namespace. Because it sees that "UID 0" in this namespace actually corresponds to your unprivileged UID 1000 on the host, the kernel allows the action, but only within that isolated environment.
A Quick Illustration
You define these mappings using the /proc/[pid]/uid_map and /proc/[pid]/gid_map files. A typical mapping file entry looks like this:
# Inside the container, UID 0 maps to host UID 1000 for a range of 1
0 1000 1
This tells the kernel: "Whenever the process inside the namespace thinks it is UID 0, treat it as UID 1000 on the host."
Capability Mapping
Once mapped to root inside the namespace, the process also gains "Capabilities." These are granular chunks of root power, such as CAP_NET_BIND_SERVICE (the ability to bind to ports below 1024). Crucially, these capabilities are local to the namespace. A process granted CAP_SYS_ADMIN inside the container can perform administrative tasks inside the container, but the kernel will reject those same requests if the process tries to affect the host system.
Key Takeaway: User Namespaces provide a security boundary that allows processes to run with "root" privileges internally while remaining unprivileged, regular users on the host system.