3 ms·
Docker has supported namespaces for a while now so that even if the user in the container is root it could be a subordinate id on the host with no administrativ
by ohiovr 7y ago
Docker has supported namespaces for a while now so that even if the user in the container is root it could be a subordinate id on the host with no administrative authority. What is new though?
- techntoke 7y agoThat still required the daemon run as root. This runs the daemon rootless as well.
- cyphar 7y agoThe daemon is running as an unprivileged user. Docker with userns-remap is still running as root (and recent vulnerabilities like CVE-2018-15664 are still a significant worry even if you ran with user namespaces enabled).