1

I'm getting started with running Docker 20.10.14 in rootless mode on Linux Mint 20 (based on Ubuntu 20.04). I've created a user named dockerd for this, UID 127 (with group dockerd, GID 139) and added the following to both /etc/subuid and /etc/subgid

dockerd:200000:65536

Now, inside a Docker container run by this dockerd user I create a file on the host file system (via a bind-mounted directory).

  • If I create it as UID 1000 in the container it maps to user 200999 on the host.
  • If I create it as UID 1 (user daemon) in the container it has UID 200000 on the host.
  • If I create it as UID 0 (user root) in the container it has UID 127 on the host.

So it appears that the sub-UID/sub-GID bindings are "1-based" and do not include UID 0. Is this how it's supposed to work or am I doing something wrong? Shouldn't I be able to map the root user in the container to as UID of my choice on the host? If so, how do I do that?

From https://unix.stackexchange.com/a/397168/107961

dockremap:165536:65536

165536 is the system UID to start the UID mapping at (Which will be UID 0 in the container)

... it sounds like the first UID in the mapping should map to UID 0, but that's not what I'm seeing.

Another weird thing is that a file owner by UID 0 on the host is owned by UID 65534 (nobody) in the container. Is that supposed to happen?

7
  • Which version of Docker?
    – muru
    Apr 11, 2022 at 10:19
  • 20.10.14. Edited that in.
    – EM0
    Apr 11, 2022 at 11:38
  • So is the uid of dockerd 127? in suck case it fits: 1+65536=65537 uids are mapped.
    – A.B
    Apr 11, 2022 at 12:53
  • 1
    @A.B. yes, the UID of dockerd is 127, but I'm not following how "it fits" that the root user inside the container is mapped to 127 and not 200000. Could you elaborate?
    – EM0
    Apr 12, 2022 at 7:22
  • 1
    Well, no, I'm not happy with it. :) I would be happy if it mapped the start of the range I specified, 200000, to UID 0. Do you know how to achieve that?
    – EM0
    Apr 12, 2022 at 12:24

0

You must log in to answer this question.

Browse other questions tagged .