rootless or rootfull with userns

[ooraini]

What are the pros and cons for running rootfull with --userns(or other options with similar effect) as opposed to running rootless.

For me in the context of long running services using systemd, you would avoid user services. And if I understand user namespaces correctly, they are equivalent in terms of privilege, once the container has started.

[rhatdan]

In my opinion the --userns=auto is better then running a bunch of services in rootless mode, mainly because the services would run in unigue usernamespaces, as opposed to running more then one service with the same rootless user, where more then likely the services are running in the same user namespace.

[ooraini]

Thanks Dan,

I don't see a lot of people talk about userns, I learned it from an article you wrote back in 2018.