A namespaced capability is a Linux capability whose authority is confined to resources and identifiers mapped into a user namespace. It gives the namespace's root process limited privileges without granting equivalent privileges on the host. section 10.3.2 section 6.1.1
The boundary applies to operations such as CAP_NET_ADMIN, CAP_CHOWN, and CAP_SETUID. Namespaced CAP_NET_ADMIN can modify the network assigned to the user namespace, not the host network. CAP_CHOWN can change ownership only to UIDs mapped into that namespace. section 10.3.2 section 6.1.1
Podman exposes the distinction through user-namespace operations:
- A container launched with --userns=auto receives a unique user namespace, isolating its identifiers from other containers and the host. section 10.3.2
- The capability list can look identical inside and outside the user namespace, while the authority behind those capabilities is restricted by identifier mappings. section 10.3.2
- Filesystem mounting additionally depends on CAP_SYS_ADMIN and a unique mount namespace, limiting where mount changes are visible. section 6.1.1
Testing mapped ownership
With --userns=auto:size=5000, chown 6000 /etc/motd fails because UID 6000 is unmapped; chown 4000 /etc/motd succeeds because UID 4000 is mapped. section 10.3.2
# podman run --rm ubi8 capsh --print | grep Current Current: = cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill, cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_sys_chroot, cap_setfcap+eip # podman run --rm --userns=auto ubi8 capsh --print | grep Current Current: = cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill, cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_sys_chroot, cap_setfcap+eip
Compare capability output for ordinary and --userns=auto containers, then use the related ownership commands to observe the namespace boundary. section 10.3.2
