Containers unplugged: understanding user namespaces
summary
Explains that user namespaces let a process be UID 0 inside a namespace while remaining an unprivileged UID outside, with 38 capabilities split into fine-grained rights; shows concrete commands (example: unshare -u -r to create a user namespace with automatic root mappings) and the exact UID/GID mapping format (for example 0->1000). Demonstrates that being “root” inside only grants power over resources owned by that namespace (cannot bind <1024 if the network namespace is owned elsewhere), includes a small Go tool to draw namespace hierarchies and live shell demos.
AI-written summary · about
chapters (11)
- 0:00Start
- 4:21Capabilities
- 6:54Namespaces Provide Isolation
- 7:46User Name Spaces
- 12:43Route Mapping
- 17:31User Namespaces and Capabilities
- 24:49Bash Shell
- 32:57Fake Root
- 34:52Fire Jail and Flat-Pack
- 42:02When Does a Process Have Capabilities inside a Namespace
- 42:52When Does the Process Have Capabilities in a User Name Space
related talks
54mUnderstanding user namespaces
47mLinux user namespaces: a blessing and a curse
01h 03mLinux Namespaces for Fun and Isolation
42mWhat's New in the User Namespace
35mThe Reality of Rootless Containers
39mLinux User Namespaces: A Blessing and a Curse
32mLinux user namespaces: a blessing and a curse
38mUnderstanding root inside and outside a container