Description

User namespaces are a long awaited feature, on which Phil Estes (@estesp) did some amazing work (see #12648). Unfortunately, the integration unexpectedly conflicted with the recent introduction of libnetwork.

We want to fix this for 1.9.0 and be able to merge Phil's work, which means:

• All containers have their own user namespace (effectively preventing the use of --net=host or --net=container:<id>).
• A daemon-wide setting remaps the root user for all containers.

How to

We need the following:

• Patch to libcontainer to enable a hook after namespaces creation (Add prestart/poststop hooks to runc opencontainers/runc#160) - while the hooks in runc/160 are for runC configs specifically, a separate PR (Implement hooks in libcontainer code base opencontainers/runc#261) brought the same function into libcontainer directly and is merged and already vendored into Docker with the 0.0.4 vendor merge
• Patch to libnetwork to enable a single entrypoint to be called in that hook (Design change to accomodate User namespace requirement libnetwork#429) - PR Vendor-in libnetwork 2baa2ddc78b42f011f55633282ac63a72e1b09c1 #16282 was merged 9/14
• Patch to connect the libcontainer pre-start hook to the new libnetwork sandbox "setExternalKey" function - PR Use libcontainer hook for network namespace info passing to libnetwork's sandbox #16305 merged 9/16
• Re-submitting the user namespace integration PR (@estesp) Phase 1 implementation of user namespaces as a remapped container root #12648 - branch currently has UI as experimental; can be moved into master when necessary