The best way to prevent privilege-escalation attacks from within a container is to configure your container’s applications to run as unprivileged users. For containers whose processes must run as the root user within the container, you can re-map this user to a less-privileged user on the Docker host. The mapped user is assigned a range of UIDs which function within the namespace as normal UIDs from 0 to 65536, but have no privileges on the host machine itself.
testuser:231072:65536

Popularity 1/10 Helpfulness 1/10 Language shell

Source: docs.docker.com

Tags: docker isolate shell containers

Link to this answer
Share Copy Link

Contributed on Feb 12 2023

DreamCoder

0 Answers Avg Quality 2/10

docker restricted user Isolate containers with a user namespace best practices

Contents

More Related Answers

docker restricted user Isolate containers with a user namespace best practices

Closely Related Answers

docker restricted user Isolate containers with a user namespace

docker restricted user Isolate containers with a user namespace best practices

Grepper

Documentation

Social

Legal

Contact

Oops, You will need to install Grepper and log-in to perform this action.