DCA · Question #63
Is this a Linux kernel namespace that is disabled by default and must be enabled at Docker engine runtime to be used? Solution: user
The correct answer is A. Yes. The user Linux kernel namespace is disabled by default in Docker and needs to be explicitly enabled at engine runtime to provide rootless container execution.
Question
Is this a Linux kernel namespace that is disabled by default and must be enabled at Docker engine runtime to be used? Solution: user
Options
- AYes
- BNo
How the community answered
(32 responses)- A75% (24)
- B25% (8)
Why each option
The `user` Linux kernel namespace is disabled by default in Docker and needs to be explicitly enabled at engine runtime to provide rootless container execution.
The `user` namespace, which maps container UIDs/GIDs to different UIDs/GIDs on the host, is disabled by default in Docker due to its advanced security implications and potential complexities. It must be explicitly configured, for instance via the `userns-remap` daemon option, to be utilized for rootless container execution.
The `user` namespace is specifically designed for enhanced security through user ID remapping and is an opt-in feature, not enabled by default in Docker.
Concept tested: Docker user namespaces
Source: https://docs.docker.com/engine/security/userns-remap/
Topics
Community Discussion
No community discussion yet for this question.