Hacker News Reader

I wondered if this is what Unraid already does: yes its mentioned at https://wiki.unraid.net/UnRAID_6/Overview#Containers

> The cornerstone of Docker is in its ability to use Linux control groups, namespace isolation, and images to create isolated execution environments in the form of Docker containers.

If you want to run dockers at home, i suggest you give it a try. All you need is an old computer and a USB (it runs in RAM). Unraid basically is Linux with a (happy little) webinterface for NAS shares + apps.

The web page doesn't read like it's enabling userns-remap, to me.

Just create a user in the Dockerfile, change to him and chroot the container application directory to the created user

This only works if you trust all your docker images and audit them for root processes. Even then you still have setuid binaries and other privilege escalation risks, if you inherit from dockerhub images etc.

Thank you. I didn’t know about this.