Lesson 2.71: Rootless containers and user namespaces
A rootless container lets an ordinary user run software that believes it is root. The trick is a user namespace: inside, the process has UID 0; outside, the kernel sees an unprivileged UID from a range the admin granted in /etc/subuid. If two users are given the same range, their containers share host UIDs and can read each other's files. In the lab you trace a container's nginx from its inside UID to its host UID, read the mapping, find two users with overlapping ranges and separate them.
17 min
You will learn to
- Explain how a user namespace maps container UIDs to host UIDs
- Read /proc/PID/uid_map
- Read /etc/subuid and spot overlapping ranges
- Work out the host UID of a container user
- Fix an overlap and check your own mapping with podman unshare
Key terms
- User namespace
- A kernel feature that gives a process its own view of UIDs: root inside, unprivileged outside.
- uid_map
- /proc/PID/uid_map: lines of inside UID, outside UID, count.
- /etc/subuid, /etc/subgid
- Ranges of host UIDs and GIDs each user may use in their namespaces: user:start:count.
- Rootless container
- A container started by an ordinary user, with no root daemon.
- podman unshare
- Runs a command inside your rootless user namespace, as its root.
← Mount options: noexec, nosuid, nodev · All lessons · Protecting the audit trail →