Following docker instructions, I've run a docker with dockerd --userns-remap=default which added this line to the /etc/subuid file:
dockremap:165536:65536
I don't understand what it means, please explain.
-
1The link you mention describes exactly what it means.– ShadurOct 10, 2017 at 9:27
Add a comment
|
1 Answer
The subordinate uid file contains a list of users and the user ids that the user is allowed to impersonate.
In the example:
dockremap:165536:65536
dockremapis the name of the system user. This can be a UID as well.165536is the system UID to start the UID mapping at (Which will be UID 0 in the container)65536is the number of UIDs allowed on top of UID 0 to be mapped. So 165536 + 65536 = 231072 will be the highest UID mapped to thedockremapuser.
In Docker terms, dockremap is the user the container will run as when you specify --userns=dockremap. UID 0 in the container will be UID 165536 on the system. UID 1 in the container will be 165537 etc.
-
1So, it means that if docker does not use user namespace then UID 0 in the container will be UID 0 on the system. So, the root (uid=0) in the container is root on the system, yes? Oct 10, 2017 at 8:27
-
Correct, and any other UID used in a container will map to that UID outside the container as well.– MattOct 10, 2017 at 8:57
-
Although containers do provide some limitations so a user inside a container doesn't have access to everything a user would outside a container.– MattOct 10, 2017 at 8:58
-
thanks. "Although containers do provide some limitations so a user inside a container doesn't have access to everything a user would outside a container. " How do they do it? You can refer me somewhere. I suppose that the process that is run under container has less capabilities, but it is only my suspicion Oct 10, 2017 at 10:20
-