# Docker run all the things with user namespaces

DevFeed: [Docker run all the things with user namespaces](<https://devfeed.tech/articles/docker-run-all-the-things-with-user-namespaces-35161.md>)

Original publisher: [Read original article](<https://blog.jessfraz.com/post/docker-run-all-the-things-with-userns/>)

Published: 2016-01-08T17:33:46Z

Content type: tutorial

Language: en

Sources: [Jessie Frazelle](<https://devfeed.tech/sources/jessie-frazelle.md>)

Topics: [Docker](<https://devfeed.tech/topics/docker.md>), [Containers](<https://devfeed.tech/topics/containers.md>), [Security](<https://devfeed.tech/topics/security.md>), [Linux](<https://devfeed.tech/topics/linux.md>)

Tags: [chrome](<https://devfeed.tech/tags/chrome.md>), [command](<https://devfeed.tech/tags/command.md>), [containers](<https://devfeed.tech/tags/containers.md>), [docker](<https://devfeed.tech/tags/docker.md>), [linux](<https://devfeed.tech/tags/linux.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

A practical guide to running desktop containers with Docker user namespaces, including Chrome, notification services, Irssi, and Docker-in-Docker. It explains the required groups, devices, security profiles, capabilities, and volume sharing.

## Source excerpt

If you weren't aware user namepace support was added to Docker awhile back in the "Experimental" builds. But with the upcoming release of Docker Engine 1.10.0, Phil Estes is working on moving it into stable. Now this is all super exciting and blah blah blah, but what I am going to talk about today is how I started running all the containers from my Docker Containers on the Desktop with the new user namespace support. The containers/images in that post were already doing some linux-y magic, but with a little more, they are perfect. I'm not going to go through them all but I will go through some interesting ones, including even how to run Docker-in-Docker. Chrome This one was shockingly easy. The only things I needed to add to my original command were --group-add video and --group-add audio. Makes sense right.. we obviously want to be a member of those groups to watch Taylor Swift music videos. The full command is below. I even made a custom seccomp whitelist for chrome, you can view it in my dotfiles repo: github.com/jessfraz/dotfiles. Seccomp will be shipped in 1.10 as well, along with a default whitelist! (But I degress that is not the point of this blog post.) Dockerfile $ docker run -d \ --memory 3gb \ -v /etc/localtime:/etc/localtime:ro \ -v /tmp/.X11-unix:/tmp/.X11-unix \ -e DISPLAY=unix$DISPLAY \ -v $HOME/Downloads:/root/Downloads \ -v $HOME/.chrome:/data \ -v /dev/shm:/dev/shm \ --security-opt seccomp:/etc/docker/seccomp/chrome.json \ --device /dev/snd \ --device /dev/dri \ --device /dev/video0 \ --group-add audio \ --group-add video \ --name chrome \ jess/chrome --user-data-dir=/data Notify-osd and Irssi Now I have always run my notifications daemon in a container, because that stuff is nasty to install, so many dependencies, ewwww. This one was a bit more tricky beacuase it involves dbus but it is a way cleaner solution than the way I was originally running it. Dockerfile $ docker run -d \ -v /etc/localtime:/etc/localtime:ro \ -v /tmp/.X11-unix:/tmp/.X11-un