The networkPolicy will block the traffic from a pod bearing the tier: backend label, to a pod bearing the tier:
frontend label. The networkPolicy specifies that only pods with the tier: frontend label can access the pods with the app: guestbook-api and tier: backend labels on port 801. Any other traffic to the backend pods will be denied by default2. Therefore, a request issued from a pod bearing the tier: backend label, to a pod bearing the tier: frontend label will be blocked by the networkPolicy. References: Connect a Frontend to a Backend Using Services), Network Policies)

Explanation
The user namespace is a Linux kernel namespace that is disabled by default and must be enabled at Docker engine runtime to be used. The user namespace allows the host system to map its own uid and gid to some different uid and gid for containers' processes. This improves the security of Docker by isolating the user and group ID number spaces, so that a process's user and group ID can be different inside and outside of a user namespace1. To enable the user namespace, the daemon must start with --userns-remap flag with a parameter that specifies base uid/gid2. All containers are run with the same mapping range according to /etc/subuid and /etc/subgid3. References:
* Isolate containers with a user namespace
* Using User Namespaces on Docker
* Docker 1.10 Security Features, Part 3: User Namespace

Explanation
= The command docker volume inspect nginx will not display a list of volumes for a specific container. This is because docker volume inspect expects one or more volume names as arguments, not a container name1. To display a list of volumes for a specific container, you can use the docker inspect command with the --format option and a template that extracts the volume information from the container JSON output2. For example, to display the source and destination of the volumes mounted by the container nginx, you can use the following command:
docker inspect --format=' { {range .Mounts}} { {.Source}}: { {.Destination}} { {end}}' nginx References:
* docker volume inspect | Docker Docs
* docker inspect | Docker Docs