User namespace remapping in Docker - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is user namespace remapping in Docker?

User namespace remapping is a Docker feature that maps container user IDs to different user IDs on the host. This improves security by isolating container users from host users.

beginner

Why use user namespace remapping in Docker?

It reduces the risk of privilege escalation by ensuring container root users do not have root privileges on the host system.

intermediate

Which Docker daemon configuration file is used to enable user namespace remapping?

The Docker daemon configuration file is /etc/docker/daemon.json where you can set the "userns-remap" option.

intermediate

What is the effect of setting "userns-remap": "default" in Docker daemon.json?

It enables user namespace remapping using a default user and group created by Docker to map container users to host users.

intermediate

How can you verify if user namespace remapping is active on a running Docker daemon?

Run the command `docker info` and check the "Security Options" section for "name=userns" entries.

What does user namespace remapping do in Docker?

A Removes all user IDs from containers

B Maps container user IDs to different host user IDs

C Disables user permissions inside containers

D Shares the same user IDs between container and host

User namespace remapping maps container user IDs to different host user IDs to improve security.

Where do you configure user namespace remapping in Docker?

A /etc/docker/daemon.json

B /etc/docker/config.yaml

C ~/.docker/config.json

D /usr/bin/docker

User namespace remapping is configured in the Docker daemon configuration file /etc/docker/daemon.json.

What is the default value to enable user namespace remapping in Docker daemon.json?

A "userns-remap": "root"

B "userns-remap": "none"

C "userns-remap": "default"

D "userns-remap": "disabled"

Setting "userns-remap": "default" enables user namespace remapping with Docker's default user.

How can you check if user namespace remapping is active?

A Run `docker info` and look for userns in Security Options

B Run `docker ps` and check container IDs

C Run `docker version` and check client info

D Run `docker logs` on any container

The `docker info` command shows if user namespace remapping is active under Security Options.

What security benefit does user namespace remapping provide?

A Shares host user permissions with containers

B Allows containers to run as host root

C Disables all container users

D Prevents container root from being host root

User namespace remapping prevents container root users from having root privileges on the host.

Explain how user namespace remapping improves Docker container security.

Think about how user IDs inside containers relate to host system users.

Describe the steps to enable user namespace remapping on a Docker host.

Focus on configuration file and verification commands.