How boxr runs rootless: namespaces, a trampoline, and uid mapping boxr is a rootless OCI container engine in Rust. No daemon, no sudo, no setuid helper. People often ask how the isolation actually works under the hood, so here is the full story of what happens on Linux between you typing boxr run and your process starting inside a container. The short version: get into a user namespace as early as possible, then do everything else from inside it. The problem: threads and...