With the 1.10 release, Docker added a huge list of new features. Whith this post we are going do analyze one of options: username spaces.
Prior to version 1.10, running an alpine container mounting an external volume /var/log/ was done as follows:
Notice that the docker deamon is running with no additional options.
The ownership of the files in the container is exactly same as the host. The user inside the container as full rights to the files. With this access, the user can even delete the files which will delete the files in the host as well. This is the problem!
Running the same code with Docker 1.10, adding the new option --userns-remap=default to the deamon, this results to:
As seen below, the deamon is running with an additional option --userns-remap=default.
The result is, owner is nobody now. Even the root user of the container cannot change the files. This is a great security upgrade that everybody was waiting for.
This feature saved us from working for a custom solution to tackle this problem.