title: Docker userns-remap cannot write to mounted directory
body: <p>I am trying out the <a href="https://docs.docker.com/engine/security/userns-remap/" rel="noreferrer">userns-remap</a> feature of Docker to create a file inside a container as <code>root</code> user and have the owner of this file as <code>test</code> user on the host.</p>
  
  <p>I've added the following to the <code>/etc/docker/daemon.json</code></p>
  
  <pre><code>{
    "userns-remap": "test:test"
  }
  </code></pre>
  
  <p>The remapping seems to have taken place based on the daemon logs</p>
  
  <pre><code>User namespaces: ID ranges will be mapped to subuid/subgid ranges of: test:test
  </code></pre>
  
  <p>and the entries <code>test:100000:65536</code> and <code>test:100000:65536</code> have been added to <code>/etc/subuid</code> and <code>/etc/subgid/</code> files, respectively.</p>
  
  <p>But when I start a container and try to create a file in the working dir, it fails</p>
  
  <pre><code>test@box:~$ docker run -v /home/test/tmp:/somedir -w /somedir -it ubuntu:16.04 /bin/bash
  root@11ff6c42ffe1:/somedir# touch file.txt
  touch: cannot touch 'file.txt': Permission denied
  
  root@11ff6c42ffe1:/somedir# ls -l
  total 0
  -rw-rw-r-- 1 nobody nogroup 0 Mar 23 21:39 already_existing_file.txt
  
  root@11ff6c42ffe1:/somedir# id root
  uid=0(root) gid=0(root) groups=0(root)
  
  root@11ff6c42ffe1:/somedir# touch /file.txt
  </code></pre>
  
  <p>Creating the file in some other directory that is not mounted from the host works as expected. </p>
  
  <p>Also, if 777 permission is granted to the mounted directory, in this case <strong>/home/test/tmp</strong> on the host, file can be created successfully from inside the container. However, the newly created file has the following permissions on the host:</p>
  
  <pre><code>ls -l /home/test/tmp
  total 0
  -rw-r--r-- 1 165536 165536 0 march 29 01:36 file.txt 
  </code></pre>
  
  <p>User with id 165536 is not present in the /etc/passwd which brings us back to the start. I would expect that the <strong>root</strong> user inside the container has the same permissions as the <strong>test</strong> user on the host and that the files created by <strong>root</strong> user in the container have the owner on the host that is mapped using userns-remap, i.e. <strong>test</strong>.</p>
  
  <p>It is stated in the <a href="https://docs.docker.com/engine/security/userns-remap/#user-namespace-known-limitations" rel="noreferrer">docs</a> that</p>
  
  <blockquote>
    <p>...if volumes are mounted from the host, file ownership must be
    pre-arranged need read or write access to the volume contents.</p>
    
    <p>... One notable restriction is the inability to use the mknod command.
    Permission is denied for device creation within the container when run
    by the root user.</p>
  </blockquote>
  
  <p>Does this mean that <strong>root</strong> user inside the container cannot create files/directories inside the mounted directory, even though the owner of the mounted directory is the user that <strong>root</strong> maps to using userns-remap, in this case <strong>test</strong>?</p>
  
  <p>Any ideas how to make the working directory also writable by the user inside the container?</p>
  
  <hr>
  
  <p><strong>Docker version</strong>: 18.03.0<br>
  <strong>Ubuntu version</strong>: 16.04.1<br>
  <strong>Kernel version</strong>: 4.13.0-36-generic</p>
  
  <p>Steps to reproduce</p>
  
  <pre><code>sudo adduser test
  sudo usermod -aG docker test
  sudo echo '{ "userns-remap": "test"}' &gt;&gt; /etc/docker/daemon.json
  service docker restart
  su - test
  mkdir tmp
  docker run -v /home/test/tmp:/somedir ubuntu:16.04 touch /somedir/file.txt
  </code></pre>
  
  <p>Here are some similar questions, but not quite the same, as I would like to make this work <em>without</em> modifying the Dockerfile:</p>
  
  <ul>
  <li><a href="https://stackoverflow.com/questions/35291520/docker-and-userns-remap-how-to-manage-volume-permissions-to-share-data-betwee">Docker and --userns-remap, how to manage volume permissions to share data between host and container?</a> - exactly what is asked in this question, too, but there was no answer for 2 years, so keeping this question open</li>
  <li><a href="https://stackoverflow.com/questions/39058552/docker-non-root-bind-mount-permissions-with-userns-remap">docker non-root bind-mount permissions, WITH --userns-remap</a></li>
  <li><a href="https://stackoverflow.com/questions/30140911/can-i-control-the-owner-of-a-bind-mounted-volume-in-a-docker-image">Can I control the owner of a bind-mounted volume in a docker image?</a></li>
  <li><a href="https://stackoverflow.com/questions/32001523/docker-cant-write-to-directory-mounted-using-v-unless-it-has-777-permissions">Docker can't write to directory mounted using -v unless it has 777 permissions</a></li>
  </ul>