Move the note more up, to prevent people from starting
the daemon with --userns-remap before touching the files.
Also clarify that these steps must be done *before* enabling
userns-remap and starting the daemon.
Also fixed some minor Markup formatting issues.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
| ... | ... |
@@ -695,11 +695,17 @@ these resources are name-based, not id-based. If the numeric ID information |
| 695 | 695 |
provided does not exist as entries in `/etc/passwd` or `/etc/group`, daemon |
| 696 | 696 |
startup will fail with an error message. |
| 697 | 697 |
|
| 698 |
+> **Note:** On Fedora 22, you have to `touch` the `/etc/subuid` and `/etc/subgid` |
|
| 699 |
+> files to have ranges assigned when users are created. This must be done |
|
| 700 |
+> *before* the `--userns-remap` option is enabled. Once these files exist, the |
|
| 701 |
+> daemon can be (re)started and range assignment on user creation works properly. |
|
| 702 |
+ |
|
| 698 | 703 |
*Example: starting with default Docker user management:* |
| 699 | 704 |
|
| 705 |
+```bash |
|
| 706 |
+$ docker daemon --userns-remap=default |
|
| 700 | 707 |
``` |
| 701 |
- $ docker daemon --userns-remap=default |
|
| 702 |
-``` |
|
| 708 |
+ |
|
| 703 | 709 |
When `default` is provided, Docker will create - or find the existing - user and group |
| 704 | 710 |
named `dockremap`. If the user is created, and the Linux distribution has |
| 705 | 711 |
appropriate support, the `/etc/subuid` and `/etc/subgid` files will be populated |
| ... | ... |
@@ -708,15 +714,11 @@ at an offset based on prior entries in those files. For example, Ubuntu will |
| 708 | 708 |
create the following range, based on an existing user named `user1` already owning |
| 709 | 709 |
the first 65536 range: |
| 710 | 710 |
|
| 711 |
+```bash |
|
| 712 |
+$ cat /etc/subuid |
|
| 713 |
+user1:100000:65536 |
|
| 714 |
+dockremap:165536:65536 |
|
| 711 | 715 |
``` |
| 712 |
- $ cat /etc/subuid |
|
| 713 |
- user1:100000:65536 |
|
| 714 |
- dockremap:165536:65536 |
|
| 715 |
-``` |
|
| 716 |
- |
|
| 717 |
-> **Note:** On Fedora 22, you have to `touch` the `/etc/subuid` and `/etc/subgid` |
|
| 718 |
-> files to have ranges assigned when users are created. Once these files |
|
| 719 |
-> exist, range assignment on user creation works properly. |
|
| 720 | 716 |
|
| 721 | 717 |
If you have a preferred/self-managed user with subordinate ID mappings already |
| 722 | 718 |
configured, you can provide that username or uid to the `--userns-remap` flag. |