Comment by asveikau

It's because from a kernel perspective this part literally needs root:

> just trying to execute the command within the child container's filesystem

There is no such thing as changing your root filesystem or your uid from an an unprivileged process. There is no "just do it in user mode" either.

So they must have a root process somewhere doing it for you.

I just started googling, apparently for podman the setuid root binary is newuidmap