A user namespace maps container root to something that is not root, and the default keeps changing under you

How user namespace mapping changes what container root means, and why the setting needs an explicit decision.