github.com/blixtra/rkt@v0.8.1-0.20160204105720-ab0d1add1a43/Documentation/devel/user-namespaces.md (about)

     1  # User namespaces
     2  
     3  ## Background
     4  
     5  User namespaces is a feature of Linux that can be used to separate the user IDs and group IDs between the host and containers.
     6  It can provide a better isolation and security: the privileged user `root` in the container can be mapped to a non-privileged user on the host.
     7  
     8  ## Implementation status
     9  
    10  rkt has an experimental implementation based on systemd-nspawn.
    11  A pod can transparently use user IDs in the range 0-65535 and this range is mapped on the host to a high range chosen randomly.
    12  
    13  Before the pod is started, the ACIs are rendered to the filesystem and the owners of the files are set with `chown` in that high range.
    14  
    15  ## Future work
    16  
    17  ### Choosing the UID range
    18  
    19  When starting several pods with user namespaces, they will each get a random UID range.
    20  In order to avoid collisions, it is planned to implement a locking
    21  mechanism so that two pods will always have a different UID range.
    22  
    23  ### Working with overlayfs
    24  
    25  The initial implementation works only with `--no-overlay`.
    26  Ideally, preparing a pod should not have to iterate over all files to call `chown`.
    27  
    28  It is planned to add kernel support for a mount option to shift the user IDs in the correct range (https://github.com/coreos/rkt/issues/1057).
    29  It would make it work with overlayfs.
    30  
    31  ### Volumes
    32  
    33  When mounting a volume from the host into the pod, the ownership of the files is not shifted, so it makes volumes difficult if not impossible to use with user namespaces.
    34  The same kernel support should help here too (https://github.com/coreos/rkt/issues/1057).