title: how to prevent docker from mounting certain locations as volumes?
body: <p>there is this vulnerability in docker where one can do this:</p>
  <pre><code>docker pull ubuntu
  docker run -it --privileged -v &quot;/:/hostfs&quot; ubuntu
  chroot /hostfs
  bash
  id
  cat /etc/hostname
  acurate-host-name
  </code></pre>
  <p>even if container is not run as privileged the problem stays.</p>
  <p>even if I make docker run all containers from custom user namespace the problem stays, as in <a href="https://stackoverflow.com/questions/41991905/docker-root-access-to-host-system">here</a>:</p>
  <pre><code>myuser@840bb09a-4005-47b9-9fe7-14e7294a145a-d59dab60-e4d6-4c94-858f-f5f [ ~ ]$ docker run -it -v &quot;/:/hostfs&quot; --privileged ubuntu
  docker: Error response from daemon: privileged mode is incompatible with user namespaces.  You must run the container in the host namespace when running privileged mode.
  See 'docker run --help'.
  myuser@840bb09a-4005-47b9-9fe7-14e7294a145a-d59dab60-e4d6-4c94-858f-f5f [ ~ ]$ docker run -it -v &quot;/:/hostfs&quot; ubuntu
  Unable to find image 'ubuntu:latest' locally
  latest: Pulling from library/ubuntu
  405f018f9d1d: Pull complete 
  Digest: sha256:b6b83d3c331794420340093eb706a6f152d9c1fa51b262d9bf34594887c2c7ac
  Status: Downloaded newer image for ubuntu:latest
  root@02ae0a0c8039:/# chroot /hostfs
  sh-4.4# bash
  bash: /root/.bashrc: Permission denied
  root [ / ]# cat /etc/host
  cat: /etc/host: No such file or directory
  root [ / ]# cat /etc/hostname
  840bb09a-4005-47b9-9fe7-14e7294a145a-d59dab60-e4d6-4c94-858f-f5f
  root [ / ]# 
  </code></pre>
  <p>is there any way to fix this?</p>
  <p>is it possible to force docker not to mount certain locations on the host?</p>
  <p>is it possible to force docker to run all containers with particular user inside them, like the <code>--user somebody</code> option?</p>