User namespace remapping in Docker - Mini Project: Build & Apply

User Namespace Remapping in Docker

📖 Scenario: You are setting up Docker on a Linux system where you want to improve security by isolating container users from host users. This is done by enabling user namespace remapping, which maps container user IDs to different host user IDs.This project will guide you step-by-step to configure Docker daemon to use user namespace remapping and verify it works.

🎯 Goal: Configure Docker daemon to enable user namespace remapping with a specific user and group, then run a container to verify the remapping is active.

📋 What You'll Learn

Create a Docker daemon configuration file with user namespace remapping enabled

Specify the remapping user and group in the configuration

Restart Docker daemon to apply the configuration

Run a Docker container and verify the user namespace remapping

💡 Why This Matters

🌍 Real World

User namespace remapping helps protect the host system by isolating container users, reducing risks if a container is compromised.

💼 Career

Understanding and configuring user namespace remapping is important for DevOps engineers and system administrators to enhance container security.

1

Create Docker daemon configuration file

Create a file called /etc/docker/daemon.json with the exact content: {"userns-remap": "default"} to enable user namespace remapping using the default user.

Docker

# Create /etc/docker/daemon.json with userns-remap set to "default"
# Your code here

Need a hint?

Use echo and sudo tee to create the file with the exact JSON content.

2

Verify remapping user and group exist

Check that the system has a user called dockremap and a group called dockremap created for remapping by running id dockremap.

Docker

echo '{"userns-remap": "default"}' | sudo tee /etc/docker/daemon.json
# Run the command to check dockremap user and group
# Your code here

Need a hint?

Use the id command to check if the dockremap user and group exist.

3

Restart Docker daemon to apply configuration

Restart the Docker service by running sudo systemctl restart docker to apply the user namespace remapping configuration.

Docker

echo '{"userns-remap": "default"}' | sudo tee /etc/docker/daemon.json
id dockremap
# Restart Docker daemon below
# Your code here

Need a hint?

Use sudo systemctl restart docker to restart the Docker daemon.

4

Run a container and verify user namespace remapping

Run a Docker container with docker run --rm alpine id and observe the output. The uid and gid should be 0(root), confirming user namespace remapping is active and transparent to the container.

Docker

echo '{"userns-remap": "default"}' | sudo tee /etc/docker/daemon.json
id dockremap
sudo systemctl restart docker
# Run the container and print user info below
# Your code here

Need a hint?

The output should show uid=0(root) and gid=0(root), indicating remapping is active.