User namespaces or short `userns` is a facility that allows a sub-namespace to have its own set of UIDs and GIDs. This allows to use the least privilege principle for LXC containers, but it's not limited to that use case.
Summary
The Linux kernel allows certain resources to be confined to a namespace. The practical use for this are mostly containers in the LXC sense (see lxc). However, it is also possible to start a single program and limit its view on the system (check out the man page for unshare).
User namespaces (userns) have been one of the long-awaited features for LXC, since they allow to map an unprivileged user on the host to a range of UIDs in the container and the respective GID accordingly to a range of GIDs. Since the container's processes, network, host name and so on are also confined to their child namespace, this effectively means one can run a full-fledged LXC container from an unprivileged host system account, thus limiting the scope of potential security breaches.
The main goal of userns is to allow the mapping of a UID (and GID) from the parent namespace into a range of UIDs (and GIDs) in the child namespace. So if you have a user account joe which is an ordinary unprivileged user on your system, this user could - provided the LXC container is prepared accordingly - run a container and inside the container could act as root within the boundaries of the namespace, not affecting the host adversely. The kernel would still ensure that all those processes that on the host appear to run as joe would not be able to do anything fancy with block devices and so on - access would be allowed purely on the basis of joe's permissions on the host, while inside the container files would still be owned by root (and whatever users get created there) and permission would be granted or denied based on the joe's permissions in the parent namespace and then inside the container based on the respective UIDs/GIDs as they appear from inside the container.
So in a sense namespaces (not just userns) provide a confined view of system resources, allowing fine-grained and secure jailing.
