These files belong to specific UIDs and GIDs set inside their respective Docker containers.
If you run e.g. ps faux | grep rspamd
on your Docker host, you will see that several child processes of rspamd
run with the same UID.
For me, it’s 100:101 (try ls -lan
to see the numerical IDs), which is mapped to _apt:systemd-timesync
on my Debian host system.
You can run the following command inside your mailcow folder:
docker exec -it mailcowdockerized-rspamd-mailcow-1 id _rspamd
It should output something like:
uid=100(_rspamd) gid=101(_rspamd) groups=101(_rspamd)
This means the _rspamd
user inside the container happens to have the same UID and GID as above, i.e. 100:101.
Long story short: This is normal behaviour when using Docker and nothing to worry about.