Lab 26: Rootless Docker in user namespaces

Objective

Enable user namespace remapping. Run containers and observe that container UID 0 maps to an unprivileged host UID.

Tasks

Task 1: Configure subuid / subgid

sudo groupadd dockremap
sudo useradd -r -g dockremap dockremap
echo 'dockremap:100000:65536' | sudo tee -a /etc/subuid
echo 'dockremap:100000:65536' | sudo tee -a /etc/subgid

Task 2: Configure the daemon

sudo tee /etc/docker/daemon.json > /dev/null <<'EOF'
{
  "userns-remap": "dockremap"
}
EOF
sudo systemctl restart docker

Task 3: Verify

docker run -d --name userns-test alpine sleep 3600
docker exec userns-test id
# uid=0(root) gid=0(root) groups=0(root)

# On the host:
HID=$(docker inspect userns-test --format '{{.State.Pid}}')
cat /proc/$HID/uid_map
#          0       100000      65536
# (the container's UID 0 maps to host UID 100000)
cat /proc/$HID/status | grep ^Uid
# Uid: 100000 100000 100000 100000

Task 4: Try to mount a host directory

docker run --rm -v /etc:/host-etc:ro alpine cat /host-etc/passwd | head
# This works, but the kernel sees the process as UID 100000, not 0.
# It can only read what UID 100000 can read.

Task 5: Recognise limitations

Rootless mode does not support all features:

• --privileged (no real root)
• Some network modes (host networking)
• cgroups v1 hosts (cgroups v2 is required)
• Some volume mounts

Task 6: Cleanup

docker rm -f userns-test
sudo systemctl stop docker
sudo rm /etc/docker/daemon.json
sudo systemctl start docker