Disable certain Docker run options : <p>I'm currently working on a setup to make Docker available on a high performance cluster (HPC). The idea is that every user in our group should be able to reserve a machine for a certain amount of time and be able to use Docker in a "normal way". Meaning accessing the Docker Daemon via the Docker CLI.</p>

<p>To do that, the user would be added to the Docker group. But this imposes a big security problem for us, since this basically means that the user has root privileges on that machine.</p>

<p>The new idea is to make use of the user namespace mapping option (as described in <a href="https://docs.docker.com/engine/reference/commandline/dockerd/#/daemon-user-namespace-options" rel="noreferrer">https://docs.docker.com/engine/reference/commandline/dockerd/#/daemon-user-namespace-options</a>). As I see it, this would tackle our biggest security concern that the root in a container is the same as the root on the host machine.</p>

<p>But as long as users are able to bypass this via --userns=host , this doesn't increase security in any way.</p>

<p><strong>Is there a way to disable this and other Docker run options?</strong></p>
