It's the same as docker. Podman can be used rootless because some critical components previously only part of Docker have been moved/recreated as service. Check 'crun', iirc.