Platform & DevOps·Packaging: containers and images
the process inside is uid 1000 rather than root, so a container escape lands the attacker as nobody in particular.
Rootless container
Also calledrootless mode, non-root container, user namespace remapping
Running a container as an unprivileged user, either by setting a non-root user in the image or by remapping the container's root to an ordinary host user. Default images run as root, and root inside a container is very often root on the host if anything else goes wrong, so this is one of the highest-value settings available. It costs you the ability to bind low ports and write to paths built for root, which is usually a one-line fix and occasionally a rewrite.