Hi Danilo,
Belated answer but hopefully it will help.
When you configure Docker’s “/etc/docker/daemon.json” file with {“userns-remap”: “test”}, Docker will not map root
in the container to user test
in the host as you are expecting. It will map root
in the container to the first user-ID from within the subid range for user test
, as found in /etc/subuid
and /etc/subgid
.
In your case it happens to be user-ID 165536 on the host.
This implies that in order for root
in the container to be able to write to a bind-mounted directory, the bind-mounted directory must be owned by user-ID 165536 on the host.
FYI, I recently founded a company called Nestybox, that has developed a container runtime (aka runc) that enables Docker to launch containers that always use exclusive userns mappings per container, yet support bind-mounts into the container without requiring that you modify permissions on the bind mount source.
If this sounds interesting, the software is free to download as we are looking for adopters.
Hope this helps!