My question is about how Docker instrument the storage for the container instance.
Do container applications or Docker create user namespaces when creating a new container instance?
-
Yes, they do. Do you have a more specific question, or would you just like to see how that can be seen?– UberhumusCommented Jun 11, 2022 at 9:35
-
@Uberhumus yes, I would like to know how the user namespace can be seen. Also, If I disable unprivileged_userns_clone (sysctl -w kernel.unprivileged_userns_clone=0) and try to run a docker instance in the unprivileged user, would that fail as docker cannot create a user space now ?– FrancCommented Jun 11, 2022 at 17:53
Add a comment
|
1 Answer
Docker creates namespaces. An lsns command before after docker run would show that there are extra user namespaces created.
-
Depends on how you run Docker. By default (and when running as a system service, which is the default when not stated otherwise) it doesn't create user namespaces, but can be configured to: lsns would show it didn't.– A.BCommented Jun 14, 2022 at 15:35