3 ms·
Just to clarify: user namespaces will be a great additional layer in security, but they are still a relatively new feature, with very little actual use in produ
by shykes 11y ago
Just to clarify: user namespaces will be a great additional layer in security, but they are still a relatively new feature, with very little actual use in production. You can already use them in runC [1] (Docker's low-level container runtime which we have broken out as a standalone tool). And once we have sorted out the hairy side-effects on UID mapping and network namespaces, we will integrate it into the Docker engine itself. But even then, we won't recommend running untrusted code as root inside a Linux container until the community has more time to battle-test user namespaces.
[1] https://github.com/opencontainers/runc https://github.com/opencontainers/runc
- mbreese 11y agoI think that you're missing the point (or at least talking around it). Namely - what is your timeline for actually securing Docker? Features like `docker cp` are nice, but don't help me when I really can't use Docker securely in production until things like user namespaces are running. I have multi-tenant systems and right now the only way for me to run Docker securely is to use it w/in a VM. Certainly, it will take time to battle-test anything, so the sooner that feature has been released, the sooner that we can get started doing the battle-testing. It would be helpful to have a clearer roadmap for features like this.
- cpuguy83 11y agoAnd is also not the silver-bullet people hope it to be, being that there is absolutely no FS level support for userns.