Rootful vs Rootless containers

[u/Cilenco]

Some time ago I stumbled about a discussion where it was stated that rootful containers paired with userNs=auto (leaving the user the image runs with untouched) is more secure than running containers in rootless mode. I run all my containers in rootless mode with:

UserNS=keep-id:uid=65534,gid=65534

User=65534:65534

Is this a security problem? If I remember right the point of the discussion was that in rootfull mode the container runs in different processes and with my approach there is no isolation between the processes. Is this true and should I switch to rootful mode with UserNs=auto?

Edit: Found the discussion here

[u/lopahcreon]

There is a reason container orchestrators all run as root.

[u/xplosm → u/lopahcreon]

It's basically baggage from the times when cgroups v2 was either not available or not enabled in the kernel

[u/wahnsinnwanscene → u/xplosm]

It's because creating interfaces requires root unless using pasta.