2.8 Enable user namespace support

Information

http://man7.org/linux/man-pages/man7/user_namespaces.7.html
2.https://docs.docker.com/engine/reference/commandline/daemon/
3.http://events.linuxfoundation.org/sites/events/files/slides/User%20Namespaces%20-%20ContainerCon%202015%20-%2016-9-final_0.pdf
4.https://github.com/docker/docker/issues/21050
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Please consult Docker documentation for various ways in which this can be configured depending upon your requirements. Your steps might also vary based on platform - For example, on Red Hat, sub-UIDs and sub-GIDs mapping creation does not work automatically. You might have to create your own mapping.

However, the high-level steps are as below-
Step 1- Ensure that the files/etc/subuidand /etc/subgid exist.
touch /etc/subuid /etc/subgid

Step 2- Start the docker daemon with --userns-remap flag
docker daemon --userns-remap=default &
Impact-
User namespace remapping makes quite a few Docker features incompatible and also currently breaks a few functionalities. Check out the Docker documentation and referenced links for details.
Default Value-
By default, user namespace is not remapped.

See Also

https://workbench.cisecurity.org/files/516