lxd does not run your containers -- it uses lxc to do so, and yes, lxc supports user namespaces (this is how you get rootless containers). In the end all these

lxd does not run your containers -- it uses lxc to do so, and yes, lxc supports user namespaces (this is how you get rootless containers). In the end all these tools get here by doing the same thing, they do uid/gid mapping[0 - search "UID MAPPINGS"][1] and some filesystem module (whether kernel or user space) support. Why that is necessary is basically due to how the kernel works, and how containers work in general which I will leave as an exercise in the reader (hint: a "container" struct does not exist in the linux kernel, containers are a combination of processes and isolation via namespaces and cgroups and other kernel features). What lxd provides is a layer above lxc to coordinate the containers being run (by lxc) and relevant resources on the machines you want. [0]: https://linuxcontainers.org/lxc/manpages/man5/lxc.container.conf.5.html https://linuxcontainers.org/lxc/manpages/man5/lxc.container.... [1]: http://docs.podman.io/en/latest/markdown/podman-create.1.html?highlight=uid%20mapping#set-uid-gid-mapping-in-a-new-user-namespace http://docs.podman.io/en/latest/markdown/podman-create.1.htm...