2.8 Enable user namespace support --userns-remap=default

Information

Enable user namespace support in Docker daemon to utilize container user to host user re-mapping. This recommendation is beneficial where containers you are using do not have an explicit container user defined in the container image. If container images that you are using have a pre-defined non-root user, this recommendation may be skipped since this feature is still in its infancy and might give you unpredictable issues and complexities.
Rationale:
The Linux kernel user namespace support in Docker daemon provides additional security for the Docker host system. It allows a container to have a unique range of user and group IDs which are outside the traditional user and group range utilized by the host system.
For example, the root user will have expected administrative privilege inside the container but can effectively be mapped to an unprivileged UID on the host system.

Solution

Please consult Docker documentation for various ways in which this can be configured depending upon your requirements. Your steps might also vary based on platform - For example, on Red Hat, sub-UIDs and sub-GIDs mapping creation does not work automatically. You might have to create your own mapping.
However, the high-level steps are as below:
Step 1: Ensure that the files /etc/subuid and /etc/subgid exist.
touch /etc/subuid /etc/subgid
Step 2: Start the docker daemon with --userns-remap flag
dockerd --userns-remap=default
Impact:
User namespace remapping makes quite a few Docker features incompatible and also currently breaks a few functionalities. Check out the Docker documentation and referenced links for details.
Default Value:
By default, user namespace is not remapped.

See Also

https://workbench.cisecurity.org/files/1726

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7a., CSCv6|18

Plugin: Unix

Control ID: 7b87455d59612f55a2e6cbb2e02ab859a1cee07ddece355da0f812b6aca997bf