Perhaps I left it a bit vague - what puzzled me was the user to whom (some) processes belong. Tools I use for containers and make all my containers rootless — unless network requirements make impossible — those make it nice & clear mapping between/from real UIDs subuids, once can see clearly what is what. Thanks @ClawdiaWolf. I wish those were in official docs (not only code).