These files belong to specific UIDs and GIDs set inside their respective Docker containers.
If you run e.g.
ps faux | grep rspamd on your Docker host, you will see that several child processes of
rspamd run with the same UID.
For me, it’s 100:101 (try
ls -lan to see the numerical IDs), which is mapped to
_apt:systemd-timesync on my Debian host system.
You can run the following command inside your mailcow folder:
docker exec -it mailcowdockerized-rspamd-mailcow-1 id _rspamd
It should output something like:
uid=100(_rspamd) gid=101(_rspamd) groups=101(_rspamd)
This means the
_rspamd user inside the container happens to have the same UID and GID as above, i.e. 100:101.
Long story short: This is normal behaviour when using Docker and nothing to worry about.