instruction: Create a Dockerfile for security
output: ```dockerfile
  from 0 to 65536, but have no privileges on the host machine itself.About remapping and subordinate user and group IDsThe remapping itself is handled by two files: /etc/subuid and /etc/subgid.
  Each file works the same, but one is concerned with the user ID range, and the
  other with the group ID range. Consider the following entry in /etc/subuid:
  
  testuser:231072:65536This means that testuser is assigned a subordinate user ID range of 231072
  and the next 65536 integers in sequence. UID 231072 is mapped within the
  namespace (within the container, in this case) as UID 0 (root). UID 231073
  is mapped as UID 1, and so forth. If a process attempts to escalate privilege
  outside of the namespace, the process is running as an unprivileged high-number
  UID on the host, which does not even map to a real user. This means the process
  has no privileges on the host system at all.
  NoteIt is possible to assign multiple subordinate ranges for a given user or group
  by adding multiple non-overlapping mappings for the same user or group in the
  /etc/subuid or /etc/subgid file. In this case, Docker uses only the first
  five mappings, in accordance with the kernel's limitation of only five entries
  in /proc/self/uid_map and /proc/self/gid_map.When you configure Docker to use the userns-remap feature, you can optionally
  specify an existing user and/or group, or you can specify default. If you
  specify default, a user and group dockremap is created and used for this
  purpose.
  WarningSome distributions do not automatically add the new group to the
  /etc/subuid and /etc/subgid files. If that's the case, you may have
  to manually edit these files and assign non-overlapping ranges. This step is
  covered in Prerequisites.It is very important that the ranges do not overlap, so that a process cannot gain
  access in a different namespace. On most Linux distributions, system utilities
  manage the ranges for you when you add or remove users.This re-mapping is transparent to the container, but introduces some
  configuration complexity in situations where the container needs access to
  resources on the Docker host, such as bind mounts into areas of the filesystem
  that the system user cannot write to.
  ```