Enable user namespace support








Set up the docker integration.


You should enable user namespace support in Docker daemon to utilize container user to host user re-mapping. This recommendation is beneficial where the containers you are using do not have an explicit container user defined in the container image. If the container images that you are using have a pre-defined non-root user, this recommendation may be skipped as this feature is still in its infancy, and might result in unpredictable issues or difficulty in configuration.


The Linux kernel “user namespace” support within the Docker daemon provides additional security for the Docker host system. It allows a container to have a unique range of user and group IDs which are outside the traditional user and group range utilized by the host system. For example, the root user can have the expected administrative privileges inside the container but can effectively be mapped to an unprivileged UID on the host system.


To find the PID of the container and list the host user associated with the container process, run:

ps -p $(docker inspect --format='{{ .State.Pid }}' <CONTAINER ID>) -o pid,user

If the container process is running as root, then this configuration may be non-compliant with your organization’s security policy.

Alternatively, you can run docker info to ensure that the userns is listed under Security Options:

docker info --format '{{ .SecurityOptions }}'


Please consult the Docker documentation for various ways in which this can be configured depending upon your requirements. Your steps might also vary based on platform.

For example, on Red Hat, sub-UIDs and sub-GIDs mapping creation do not work automatically. You might have to create your own mapping. The high-level steps are as below:

  1. Ensure that the files /etc/subuid and /etc/subgid exist: touch /etc/subuid /etc/subgid
  2. Start the docker daemon with --userns-remap flag dockerd --userns-remap=default


User namespace remapping is incompatible with a number of Docker features and also currently breaks some of its functionalities. Reference the Docker documentation and included links for details.

Default value

By default, user namespace is not remapped. Consideration should be given to implementing this in line with the requirements of the applications being used and the organization’s security policy.


  1. http://man7.org/linux/man-pages/man7/user_namespaces.7.html
  2. https://docs.docker.com/engine/reference/commandline/dockerd/#daemon-user-namespace-options
  3. http://events.linuxfoundation.org/sites/events/files/slides/User%20Namespaces%20-%20ContainerCon%202015%20-%2016-9-final_0.pdf

CIS controls

Version 6

18 Application Software Security Application Software Security