3

My /etc/subuid file contains:

...
dockremap:165536:65536

I don't understand what the dockremap line means, please explain.

I've run a docker with dockerd --userns-remap=default to make use of user namespaces.

  • The link you mention describes exactly what it means. – Shadur Oct 10 '17 at 9:27
6

The subordinate uid file contains a list of users and the user ids that the user is allowed to impersonate.

In the example:

dockremap:165536:65536

dockremap is the name of the system user. This can be a UID as well.

165536 is the system UID to start the UID mapping at

65536 is the number of UIDs allowed to be mapped. So 165536+65536 = 231072 will be the highest UID mapped to the dockremap user.

In Docker terms, dockremap is the user the container will run as when you specify --userns=dockremap. UID 0 in the container will be UID 165536 on the system. UID 1 in the container will be 165537 etc.

  • So, it means that if docker does not use user namespace then UID 0 in the container will be UID 0 on the system. So, the root (uid=0) in the container is root on the system, yes? – Gilgamesz Oct 10 '17 at 8:27
  • Correct, and any other UID used in a container will map to that UID outside the container as well. – Matt Oct 10 '17 at 8:57
  • Although containers do provide some limitations so a user inside a container doesn't have access to everything a user would outside a container. – Matt Oct 10 '17 at 8:58
  • thanks. "Although containers do provide some limitations so a user inside a container doesn't have access to everything a user would outside a container. " How do they do it? You can refer me somewhere. I suppose that the process that is run under container has less capabilities, but it is only my suspicion – Gilgamesz Oct 10 '17 at 10:20
  • The docker security page is a good resource. – Matt Oct 10 '17 at 10:42

Not the answer you're looking for? Browse other questions tagged or ask your own question.