Post Syndicated from corbet original https://lwn.net/Articles/1103429/

User namespaces are a key part of the
kernel’s toolkit for assembling containers; processes within a user
namespace can appear to have full root access to the system while gaining
no extra privileges in the wider system. At least, that is the intent. In
practice, keeping privilege contained within a user namespace has often
turned out to be difficult. As an example, consider this
small patch series from Josef Bacik, which is intended to address some
situations where a process within a user namespace can elevate the
privileges of processes outside of it.