"Eric W. Biederman" <ebied...@xmission.com> writes: > That will work, but you really don't want to run with uid == 0 mapped to > uid == 0. There are too many things in /proc and /sys and similar that > grant access to uid == 0.
Many thanks for the swift reply. If I map UID zero in the userns to a non-zero UID outside (say -1), is there any way to use the userns UIDs instead of host UIDs when accessing the container's root filesystem so I don't end up with strange file ownerships on disk? This would prevent me from using the same filesystem on physical hosts or in VMs. I don't think there's any kernel mechanism that lets me apply a UID translation layer as part of a bind mount is there? Cheers, Chris. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
