My question is about how Docker instrument the storage for the container instance.
Do container applications or Docker create user namespaces when creating a new container instance?
-
Yes, they do. Do you have a more specific question, or would you just like to see how that can be seen?Uberhumus– Uberhumus2022-06-11 09:35:11 +00:00Commented Jun 11, 2022 at 9:35
-
@Uberhumus yes, I would like to know how the user namespace can be seen. Also, If I disable unprivileged_userns_clone (sysctl -w kernel.unprivileged_userns_clone=0) and try to run a docker instance in the unprivileged user, would that fail as docker cannot create a user space now ?Franc– Franc2022-06-11 17:53:54 +00:00Commented Jun 11, 2022 at 17:53
Add a comment
|
1 Answer
Docker creates namespaces. An lsns command before after docker run would show that there are extra user namespaces created.
-
Depends on how you run Docker. By default (and when running as a system service, which is the default when not stated otherwise) it doesn't create user namespaces, but can be configured to: lsns would show it didn't.A.B– A.B2022-06-14 15:35:22 +00:00Commented Jun 14, 2022 at 15:35