User namespace remapping in Docker - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the primary purpose of user namespace remapping in Docker?

User namespace remapping changes how user IDs inside a container map to user IDs on the host. What is the main reason Docker uses this feature?

A To isolate container users from host users for better security

B To improve container startup speed by caching user IDs

C To allow containers to share the same user IDs as the host

D To enable containers to run without any user permissions

💡 Hint

Think about how containers can be safer by separating their users from the host system users.

User namespace remapping isolates container user IDs from host user IDs, reducing the risk that a container user can affect the host system. This improves security by preventing privilege escalation.

💻 Command Output

intermediate

What is the output of 'docker info' regarding user namespace remapping when it is enabled?

After enabling user namespace remapping in Docker, you run docker info. What line indicates that user namespace remapping is active?

Docker

docker info

A Userns Mode: private

B Userns Mode: remapped

C Userns Mode: enabled

D Userns Mode: host

💡 Hint

Look for the exact phrase Docker uses to show remapping is active.

When user namespace remapping is enabled, docker info shows Userns Mode: remapped. This confirms the feature is active.

❓ Configuration

advanced

Which configuration snippet correctly enables user namespace remapping in Docker daemon.json?

You want to enable user namespace remapping by editing /etc/docker/daemon.json. Which snippet is correct?

A

{
  "userns-remap": "default"
}

B

{
  "userns_remap": "default"
}

C

{
  "userns-remap": true
}

D

{
  "user_namespace_remap": "default"
}

💡 Hint

Check the exact key name Docker expects in the JSON config.

The correct key is "userns-remap" with a hyphen, and the value is usually "default" to enable remapping with default settings.

❓ Troubleshoot

advanced

Why does Docker fail to start after enabling user namespace remapping with an invalid subuid range?

You enabled user namespace remapping but Docker daemon fails to start. You suspect the /etc/subuid and /etc/subgid files are misconfigured. What is the most likely cause?

A The subuid and subgid ranges overlap with existing host user IDs

B The Docker version does not support user namespace remapping

C The Docker daemon.json file has a syntax error unrelated to userns

D The subuid and subgid files are missing or empty for the remap user

💡 Hint

Check if the remap user has assigned subordinate IDs in the system files.

User namespace remapping requires the remap user to have valid subordinate UID and GID ranges in /etc/subuid and /etc/subgid. Missing or empty entries cause Docker to fail starting.

🔀 Workflow

expert

What is the correct sequence to enable user namespace remapping and verify it works?

Arrange the steps in the correct order to enable user namespace remapping on a Docker host and confirm it is active.

A 3,2,1,4

B 1,3,2,4

C 3,1,2,4

D 1,2,3,4

💡 Hint

Think about verifying prerequisites before changing config, then restarting, then checking status.

First verify the subordinate UID/GID mappings exist (3). Then edit daemon.json (1). Restart Docker (2). Finally, confirm with docker info (4).