Docker is running container as _apt user

As I was trying to explain, the username does not matter at all. Without rootless Docker or using user namespaces both the container and the host will use UID 0 for the root user. Everything else can be different. Each container has its own user database and the container “decides” which ID will belong to which username. So you see the owner of a process is _apt because the host knows UID 100 and “thinks” it is the ID of “_apt” so it shows you to help you see a friendly name. If the container uses a userid which is not mapped to a username on the host, then you will see the userid not the name. No other difference.

User namespaces are to separate the user IDs in a container from the host. So the root user gets UID 0 on the host and it gets for example UID 100000 inside the container, except that the container “thinks” it has UID 0. It is just lying to the container about the UID.

Rootless containers are similar. If you don’t run the container as root, you will not have the permission to use any ID like UID 0 so it has to use user namespaces.