liveBook · Manning

--userns=auto

As explained in Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more

--userns=auto is a Podman option that automatically assigns a container a private user namespace with subordinate identity mappings.

--userns=auto gives each Podman container a private user namespace and a nonoverlapping UID/GID range. Podman examines image identities and allocates at least 1,024 IDs by default, improving isolation between containers. section 10.3.1

Namespaced capabilities affect only mapped identities and associated namespaces: container root retains limited privileges, while host processes receive no host capabilities. Rootless use is constrained by the user's subordinate range; 65,536 IDs permit at most 64 default-sized containers. section 10.3.2 section 10.3.3

How Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more covers it

How deep it goes
Explains allocation, mapping inspection, sizing, reclamation, capabilities, and rootless limits, but stops short of kernel implementation details.
Examples
Uses /proc/self/uid_map, /etc/subuid, /etc/subgid, chown, and repeated --rm containers to demonstrate mappings and reuse.
What it assumes
Assumes Linux UID/GID and user-namespace basics while defining subordinate ranges, mappings, capabilities, and rootless constraints.
What you can do after
Operate/configure Podman containers with automatic identity mappings, explicit namespace sizes, and verified isolation boundaries.
How it connects
Connects user namespaces with subordinate IDs, Linux capabilities, rootless containers, and container isolation.
Cover of Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more
liveBookmanning.com
Read Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more. The section links point to the parts of the book it draws on.