Docker and --userns-remap, how to manage volume permissions to share data between host and container? : <p>In docker, files created inside containers tend to have unpredictable ownership while inspecting them from the host. The owner of the files on a volume is root (uid 0) by default, but as soon as non-root user accounts are involved in the container and writing to the file system, owners become more or less random from the host perspective.</p>

<p>It is a problem when you need to access volume data from the host using the same user account which is calling the docker commands. </p>

<p>Typical workarounds are </p>

<ul>
<li>forcing users uIDs at creation time in Dockerfiles (non portable) </li>
<li>passing the UID of the host user to the <code>docker run</code> command as an environment variable and then running some <code>chown</code> commands on the volumes in an entrypoint script. </li>
</ul>

<p>Both these solutions can give some control over the actual permissions outside the container.</p>

<p>I expected user namespaces to be the final solution to this problem. I have run some tests with the recently released version 1.10 and --userns-remap set to my desktop account. However, I am not sure that it can make file ownership on mounted volumes easier to deal with, I am afraid that it could actually be the opposite.</p>

<p>Suppose I start this basic container</p>

<pre><code>docker run -ti -v /data debian:jessie /bin/bash
echo 'hello' &gt; /data/test.txt
exit
</code></pre>

<p>And then inspect the content from the host : </p>

<pre><code>ls -lh /var/lib/docker/100000.100000/volumes/&lt;some-id&gt;/_data/

-rw-r--r-- 1 100000 100000 6 Feb  8 19:43 test.txt
</code></pre>

<p>This number '100000' is a sub-UID of my host user, but since it does not correspond to my user's UID, I still can't edit test.txt without privileges. This sub-user does not seem to have any affinity with my actual regular user outside of docker. It's not mapped back.</p>

<p>The workarounds mentioned earlier in this post which consisted of aligning UIDs between the host and the container do not work anymore due to the <code>UID-&gt;sub-UID</code> mapping that occurs in the namespace.</p>

<p>Then, is there a way to run docker with user namespace enabled (for improved security), while still making it possible for the host user running docker to own the files generated on volumes? </p>
