Lesson 4.51: User-namespace remapping for Docker
By default root in a Docker container is UID 0 on the host too, so any escape lands as real root. With userns-remap the daemon runs every container in a user namespace: root inside becomes an unprivileged UID from a subordinate range outside. In the lab you confirm the shop's web container runs as host root, enable remapping, see what Docker creates for it (and what it hides: the old containers and images), start the container again and read its new UID and map.
16 min
You will learn to
- Show that container root is host root by default
- Enable userns-remap in /etc/docker/daemon.json
- Find the dockremap user and its subordinate ranges
- Explain why existing containers and images disappear
- Read a remapped container's UID and uid_map
Key terms
- userns-remap
- dockerd setting that runs all containers in a user namespace mapped to a subordinate UID range.
- dockremap
- The system user Docker creates for 'default'; its /etc/subuid range supplies container UIDs.
- DockerRootDir
- Where dockerd keeps images and containers; with remapping, a subdirectory per range.
- --userns=host
- Per-container opt-out of remapping; needed for --privileged or host namespaces.
- Rootless mode
- Running the daemon itself as an ordinary user; a stronger, separate option.
← Per-service network policy with systemd · All lessons · MFA fatigue and account takeover →