The Debian 11 release notes say: « From Linux 5.10, all users are allowed to create user namespaces by default. This will allow programs such as web browsers a

The Debian 11 release notes say: « From Linux 5.10, all users are allowed to create user namespaces by default. This will allow programs such as web browsers and container managers to create more restricted sandboxes for untrusted or less-trusted code, without the need to run as root or to use a setuid-root helper. The previous Debian default was to restrict this feature to processes running as root, because it exposed more security issues in the kernel. However, as the implementation of this feature has matured, we are now confident that the risk of enabling it is outweighed by the security benefits it provides. If you prefer to keep this feature restricted, set the sysctl: user.max_user_namespaces = 0 Note that various desktop and container features will not work with this restriction in place, including web browsers, WebKitGTK, Flatpak and GNOME thumbnailing. » Does anyone know a reason to keep this feature enabled on a server, other than Docker's rootless mode?