How is that so when the article says "NOTE: Until we have user namespaces implemented in the kernel and used by the LXC we will NOT say that LXC is root safe"?
a root in a namespace is a root in a namespace.
if its a fs namespace, can't chroot up.
if its also a network namespace, can't use network resources that aren't allowed by the namespace. and so on.
but, a regular user can't create a namespace with root in it. that's what's missing for example.
Note that, again, RSBAC does support fully virtual users for example (akin to namespaces for users)
