Re:Dockerfile Security Best Practices
by lawnchair_larry on Wednesday October 14, 2020 @03:34PM
(#24780592)
A completely new user:group namespace is created inside the container. This is, in very large part, what Linux namespaces are for.
No. root inside is root outside (if you can get outside). The behavior you describe only applies if you enable user namespace remapping, which docker doesn’t by default.
No. root inside is root outside (if you can get outside). The behavior you describe only applies if you enable user namespace remapping, which docker doesn’t by default.