What is userns-remap, and what does it protect against?

It remaps the container's root user (UID 0) to an unprivileged UID on the host, so even if a process achieves what looks like root inside the container, it actually has only unprivileged host permissions — adding defense in depth against container-breakout scenarios.