Support privileged with user namespaces

[mrunalp]

Currently, privileged isn't supported when user namespaces are on. However, there are many use cases where one would want to run privileged containers side by side with user namespaced containers.

How about we disable (don't apply) user namespace mappings when --privileged is passed, so we can have privilege mean the same whether user namespaces are in use or not?

[mrunalp]

@estesp @crosbymichael @LK4D4 ping

[coolljt0725]

+1 for this, if use the --userns-remap, we can't access to the device add by --device on docker run/create, I think we should add a flag on docker run/create to disable user namespace mapping

[rhatdan]

Yes --privileged should mean disable all container separation including user namespace.

[rhatdan]

If you want to disable some separation then you need to do

--securityopt label:disabled
or

--cap-add all

But --privileged should mean root==root

[LK4D4]

This was fixed as far as I know.

[ziermmar]

How was this fixed? I don't seem to be able to use privileged mode with user namespaces on the latest stable release yet.

[thaJeztah]

@ziermmar running --privileged on a container with userns enabled will never work (because the container's user doesn't have privileges on the host), that will never change as that's the intent of running with userns enables.

However, #20111 allows you to disable userns remapping for a single container, so that you can start a privileged container if userns is enabled on the daemon. That was previously not possible, and is implemented by #20111

[ziermmar]

Ah, thanks for clearing that up! In my case, I was just missing --userns=host for the container I wanted to run in -privileged mode.