direction: right

hote: "One host, two independent engines" {
  rootful: "Rootful engine, started by root" {
    sock1: "/run/docker.sock\nowner root, group docker"
    d1: "dockerd and containerd\nroot processes"
    data1: "/var/lib/docker\nroot's images and volumes"
    sock1 -> d1
    d1 -> data1
  }
  rootless: "Rootless engine, started by c37-dev (UID 1002)" {
    sock2: "/run/user/1002/docker.sock\nowner c37-dev"
    rk: "RootlessKit\nuser namespace" { class: accent }
    d2: "dockerd and containerd\nc37-dev processes"
    data2: "~/.local/share/docker\nc37-dev's images and volumes"
    sock2 -> d2
    net: "Detached network namespace (--detach-netns)\nonly bridge-network containers live in it\nthe daemon stays in the host network namespace"
    rk -> d2: "starts"
    rk -> net: "creates"
    d2 -> data2
  }
  uid: "UID mapping inside the namespace" {
    u0: "Container UID 0\nHost UID 1002"
    u1: "Container UIDs 1 to 65536\nHost UIDs 231072 to 296607"
  }
  rootless.rk -> uid: "applies"
}