Rootless Docker and Its Hidden Security Trade-Offs
Summary
The article explains how rootless Docker uses user namespaces (via RootlessKit) to reduce host-root risk, how BuildKit operates in rootless mode, and the security trade-offs of disabling seccomp and AppArmor. It also discusses limitations, such as overlayfs constraints and networking, and emphasizes that rootless is not a complete security solution but a risk-reduction measure with careful configuration.