How Podman userns=auto strengthens container isolation
Podman offers two complementary ways to reduce container risk. Rootless Podman limits the privileges of the process that creates and manages containers. --userns=auto gives containers separate user-ID mappings, isolating their identities from each other. Together, they protect both the host and workloads sharing a server.
What --userns=auto changes
A user namespace maps IDs inside a container to different IDs outside it. Container root can appear as UID 0 inside without being host root. With --userns=auto, Podman allocates a separate subordinate UID/GID range for each container from the ranges available to it. This reduces overlap between containers that would otherwise share an identity mapping.
Daniel J Walsh (rhatdan) put the motivation plainly: “the services would run in unigue usernamespaces,” rather than multiple services sharing the same rootless user's namespace. The spelling is his original. The Red Hat walkthrough shows how the modes map IDs and how to inspect /proc/self/uid_map inside a container.
Add rootless protection for the host
Running Podman as a non-root account means image pulls and container setup do not start with host-root privileges. That complements the per-container mapping from --userns=auto: one limits the management process, the other separates workload identities. Walsh notes the distinction: with rootless Podman, what the Podman process can do “would be limited to the user access.”
The useful combination is rootless Podman with --userns=auto, where supported and provisioned with enough subordinate IDs. Walsh described that option as “probably the most secure.” It combines a non-root management process with distinct ID ranges for the services it runs.
What this means for Bundar
Bundar uses Podman's --userns=auto for application containers by default. Each auto-mapped container gets its own ID range. With a non-root SSH account, Podman itself also runs rootless; with a root account, the workload isolation remains but Podman management runs as root. Configure the SSH account and subordinate-ID ranges to get the combination you want.
Rootless reduces the host privilege of container management; automatic user namespaces reduce shared identities between workloads. For a multi-service server, using both gives Podman two useful layers of protection.