The technical explanation of what is unprivileged container is quite good. However, it is not for ordinary PC user. Is there a simple answer when and why people should use unpriviliged containers, and what are their benefits and downsides?
What are benefits and downsides of unprivileged containers?
security;virtual machine;not root user;lxc;privileges
Running unprivileged containers is the safest way to run containers in a production environment. Containers get bad publicity when it comes to security and one of the reasons is because some users have found that if a user gets root in a container then there is a possibility of gaining root on the host as well. Basically what an unprivileged container does is mask the userid from the host . With unprivileged containers, non root users can create containers and  will have and appear in the container as root but will appear as userid 10000 for example on the host (whatever you map the userids as). I recently wrote a blog post on this based on Stephane Graber's blog series on LXC (One of the brilliant minds/lead developers of LXC and someone to definitely follow). I say again, extremely brilliant.From my blog:From the container:lxc-attach -n ubuntu-unprivedroot@ubuntu-unprived:/# ps -efUID        PID  PPID  C STIME TTY          TIME CMDroot         1     0  0 04:48 ?        00:00:00 /sbin/initroot       157     1  0 04:48 ?        00:00:00 upstart-udev-bridge --daemonroot       189     1  0 04:48 ?        00:00:00 /lib/systemd/systemd-udevd --daemonroot       244     1  0 04:48 ?        00:00:00 dhclient -1 -v -pf /run/dhclient.eth0.pidsyslog     290     1  0 04:48 ?        00:00:00 rsyslogdroot       343     1  0 04:48 tty4     00:00:00 /sbin/getty -8 38400 tty4root       345     1  0 04:48 tty2     00:00:00 /sbin/getty -8 38400 tty2root       346     1  0 04:48 tty3     00:00:00 /sbin/getty -8 38400 tty3root       359     1  0 04:48 ?        00:00:00 cronroot       386     1  0 04:48 console  00:00:00 /sbin/getty -8 38400 consoleroot       389     1  0 04:48 tty1     00:00:00 /sbin/getty -8 38400 tty1root       408     1  0 04:48 ?        00:00:00 upstart-socket-bridge --daemonroot       409     1  0 04:48 ?        00:00:00 upstart-file-bridge --daemonroot       431     0  0 05:06 ?        00:00:00 /bin/bashroot       434   431  0 05:06 ?        00:00:00 ps -efFrom the host:lxc-info -Ssip --name ubuntu-unprivedState:          RUNNINGPID:            3104IP:             10.1.0.107CPU use:        2.27 secondsBlkIO use:      680.00 KiBMemory use:     7.24 MiBLink:           vethJ1Y7TGTX bytes:      7.30 KiBRX bytes:      46.21 KiBTotal bytes:   53.51 KiBps -ef | grep 3104100000    3104  3067  0 Nov11 ?        00:00:00 /sbin/init100000    3330  3104  0 Nov11 ?        00:00:00 upstart-udev-bridge --daemon100000    3362  3104  0 Nov11 ?        00:00:00 /lib/systemd/systemd-udevd --daemon100000    3417  3104  0 Nov11 ?        00:00:00 dhclient -1 -v -pf /run/dhclient.eth0.pid -lf /var/lib/dhcp/dhclient.eth0.leases eth0100102    3463  3104  0 Nov11 ?        00:00:00 rsyslogd100000    3516  3104  0 Nov11 pts/8    00:00:00 /sbin/getty -8 38400 tty4100000    3518  3104  0 Nov11 pts/6    00:00:00 /sbin/getty -8 38400 tty2100000    3519  3104  0 Nov11 pts/7    00:00:00 /sbin/getty -8 38400 tty3100000    3532  3104  0 Nov11 ?        00:00:00 cron100000    3559  3104  0 Nov11 pts/9    00:00:00 /sbin/getty -8 38400 console100000    3562  3104  0 Nov11 pts/5    00:00:00 /sbin/getty -8 38400 tty1100000    3581  3104  0 Nov11 ?        00:00:00 upstart-socket-bridge --daemon100000    3582  3104  0 Nov11 ?        00:00:00 upstart-file-bridge --daemonlxc       3780  1518  0 00:10 pts/4    00:00:00 grep --color=auto 3104As you can see processes are running inside the container as root but are not appearing as root but as 100000 from the host.So to sum up: Benefits - added security and added isolation for security. Downside - A little confusing to wrap your head around at first and not for the novice user.