instruction: Create a Dockerfile for security
output: ```dockerfile
  from the hello-world image.
  
  $ docker run hello-world
  Verify that a namespaced directory exists within /var/lib/docker/ named
  with the UID and GID of the namespaced user, owned by that UID and GID,
  and not group-or-world-readable. Some of the subdirectories are still
  owned by root and have different permissions.
  
  $ sudo ls -ld /var/lib/docker/231072.231072/
  
  drwx------ 11 231072 231072 11 Jun 21 21:19 /var/lib/docker/231072.231072/
  
  $ sudo ls -l /var/lib/docker/231072.231072/
  
  total 14
  drwx------ 5 231072 231072 5 Jun 21 21:19 aufs
  drwx------ 3 231072 231072 3 Jun 21 21:21 containers
  drwx------ 3 root root 3 Jun 21 21:19 image
  drwxr-x--- 3 root root 3 Jun 21 21:19 network
  drwx------ 4 root root 4 Jun 21 21:19 plugins
  drwx------ 2 root root 2 Jun 21 21:19 swarm
  drwx------ 2 231072 231072 2 Jun 21 21:21 tmp
  drwx------ 2 root root 2 Jun 21 21:19 trust
  drwx------ 2 231072 231072 3 Jun 21 21:19 volumes
  Your directory listing may have some differences, especially if you
  use a different container storage driver than aufs.The directories which are owned by the remapped user are used instead
  of the same directories directly beneath /var/lib/docker/ and the
  unused versions (such as /var/lib/docker/tmp/ in the example here)
  can be removed. Docker does not use them while userns-remap is
  enabled.Disable namespace remapping for a containerIf you enable user namespaces on the daemon, all containers are started with
  user namespaces enabled by default. In some situations, such as privileged
  containers, you may need to disable user namespaces for a specific container.
  See
  user namespace known limitations
  for some of these limitations.To disable user namespaces for a specific container, add the --userns=host
  flag to the docker container create, docker container run, or docker container exec command.There is a side effect when using this flag: user remapping will not be enabled for that container but, because the read-only (image) layers are shared between containers, ownership of the containers filesystem will still be remapped.What this means is that the whole container filesystem will belong to the user specified in the --userns-remap daemon config (231072 in the example above). This can lead to unexpected behavior of programs inside the container. For instance sudo (which checks that its binaries belong to user 0) or binaries with a setuid flag.User namespace known limitationsThe following standard Docker features are incompatible with running a Docker
  daemon with user namespaces enabled:Sharing PID or NET namespaces with the host (--pid=host or --network=host).External (volume or storage) drivers which are unaware or incapable of using
  daemon user mappings.Using the --privileged mode flag on docker run without also specifying
  --userns=host.User namespaces are an advanced feature and require coordination with other
  capabilities. For example, if volumes are mounted
  ```