No mention of user namespaces whatsoever, which is the primary security isolation mechanism for containers on linux. This is what enables "rootless" mode. Of co

No mention of user namespaces whatsoever, which is the primary security isolation mechanism for containers on linux. This is what enables "rootless" mode. Of course, this is from 2017, but user namespaces were released with linux 3.8 in February 2013. Docker particularly has always required extra work to run in rootless mode because it was released soon after in March 2013, and for whatever reason it hasn't been a priority to rework the codebase to make that the default. I switched to podman for exactly this reason as my go-to oci implementation and haven't looked back. The linux kernel features that enable various forms of isolation all require root privileges (CAP_SYS_ADMIN). Once user namespaces were a thing, that allowed you to use user namespaces to get around the root requirements for all the other isolation namespaces. All of the below still require CAP_SYS_ADMIN: CLONE_NEWCGROUP: cgroup namespace, for resource control (mem/cpu/block io/devices/network bandwith) CLONE_NEWIPC: ipc namespace for sysv ipc objects and message queues CLONE_NEWNET: network namespace, for isolated virtual networking CLONE_NEWNS: mount namespace, for isolated mounting (filesystems, etc.) CLONE_NEWPID: pid namespace, for isolated view of running processes CLONE_NEWUTS: unix timesharing system namespace, for isolation of hostname and domain name see: https://man7.org/linux/man-pages/man2/clone.2.html https://man7.org/linux/man-pages/man2/clone.2.html