Rootless Container - CI/CD Glossary Definition
A rootless container runs without root privileges on the host by mapping the container root user to an unprivileged host user via user namespaces. It limits the blast radius if a container is compromised.
In CI
Rootless builds (Podman rootless, BuildKit rootless, or Kaniko) let you build images on shared runners without granting the daemon root, which is safer for self-hosted fleets running untrusted PRs.
Related guides
Container Runtime - CI/CD Glossary DefinitionContainer Runtime: A container runtime is the software that actually runs containers from images, handling pr…
OCI Runtime Spec - CI/CD Glossary DefinitionOCI Runtime Spec: The OCI runtime spec is the Open Container Initiative standard defining how a container is…
Ephemeral Runner - CI/CD Glossary DefinitionEphemeral Runner: An **ephemeral runner** is created fresh for one job and destroyed after, giving clean, rep…