Containers isolation by namespace

This page gives the additional steps required to isolate containers with Linux user namespaces.

Ensure that Docker and Cyberwatch are installed

Create user cyberwatch:

sudo useradd --create-home --shell /bin/bash cyberwatch

Edit file /etc/subuid:
```
cyberwatch:231072:65536
cyberwatch:1001:1
```
The first line defines the mapping of user ids in a user namespace. This line is generally added automatically by the system when creating the user, but some systems do not do it automatically (some versions of CentOS for example).
For example, cyberwatch:231072:65536 means that user cyberwatch can use 65536 user ids from id 231072.
The cyberwatch:1001:1 line allows files created by root to be owned by the user with id 1001 (replace with the cyberwatch user id).

Edit file /etc/subgid:

cyberwatch:231072:65536
cyberwatch:1001:1

Restart the server:
```
sudo reboot
```

Configure docker to enable the userns-remap option:

cat >> /etc/docker/daemon.json <<EOL
{
  "userns-remap": "cyberwatch"
}
EOL

Restart docker:
```
systemctl restart docker
```

nginx certificates folder (Cyberwatch 5.31 and later)

Starting with Cyberwatch 5.31, nginx certificates are stored in the /etc/cyberwatch/ssl folder on the host instead of a Docker volume. On startup, Cyberwatch assigns this folder to the root user (UID and GID 0) and restricts access to its owner only.

With userns-remap, UID 0 on the host does not correspond to root inside the containers. The nginx container can then no longer read its certificates, preventing it from starting (container restarts in a loop, HTTPS interface unavailable).

To correct this behavior, you must specify to Cyberwatch the host UID and GID corresponding to root inside the containers.

Identify the host UID and GID corresponding to root inside the containers. When userns-remap is active, Docker displays them in the name of its active data directory:
```
docker info --format ''
```
The command returns a path like /var/lib/docker/<uid>.<gid>, for example /var/lib/docker/165536.165536: root inside the containers then corresponds to UID 165536 and GID 165536 on the host.
Enter these values in the /etc/cyberwatch/config.env file:
```
CBW_NGINX_UID=165536
CBW_NGINX_GID=165536
```
Restart Cyberwatch to apply the new permissions:
```
sudo cyberwatch restart
```

Troubleshooting

The problems that can arise from activating userns-remap are usually related to volume rights. It may be interesting to consult the logs of the database container in order to rule out permissions issues:

sudo cyberwatch logs db

Since Cyberwatch 5.31, if the nginx container does not start or if the HTTPS interface is unavailable after enabling userns-remap, check the configuration of CBW_NGINX_UID and CBW_NGINX_GID (see the nginx certificates folder section above). The logs of the nginx container help with diagnostics:

sudo cyberwatch logs nginx