beenull/moby
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge pull request #300 from AkihiroSuda/rootlesskit-060-1903

Browse source 
[19.03 backport] rootless: allow exposing dockerd TCP socket easily
This commit is contained in:
Andrew Hsu 2019-08-07 17:57:29 -07:00 committed by GitHub
commit 439ed140ee
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 15 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
docs/rootless.md
View file

@ -75,6 +75,17 @@ You can just use the upstream Docker client but you need to set the socket path
$ docker -H unix://$XDG_RUNTIME_DIR/docker.sock run -d nginx
```
### Expose Docker API socket via TCP
To expose the Docker API socket via TCP, you need to launch `dockerd-rootless.sh` with `DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS="-p 0.0.0.0:2376:2376/tcp"`.
```console
$ DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS="-p 0.0.0.0:2376:2376/tcp" \
dockerd-rootless.sh --experimental \
-H tcp://0.0.0.0:2376 \
--tlsverify --tlscacert=ca.pem --tlscert=cert.pem --tlskey=key.pem
```
### Routing ping packets
To route ping packets, you need to set up `net.ipv4.ping_group_range` properly as the root.
@ -86,8 +97,8 @@ $ sudo sh -c "echo 0 2147483647 > /proc/sys/net/ipv4/ping_group_range"
### Changing network stack
`dockerd-rootless.sh` uses [slirp4netns](https://github.com/rootless-containers/slirp4netns) (if installed) or [VPNKit](https://github.com/moby/vpnkit) as the network stack by default.
These network stacks run in userspace and might have performance overhead. See [RootlessKit documentation](https://github.com/rootless-containers/rootlesskit/tree/v0.4.0#network-drivers) for further information.
These network stacks run in userspace and might have performance overhead. See [RootlessKit documentation](https://github.com/rootless-containers/rootlesskit/tree/v0.6.0#network-drivers) for further information.
Optionally, you can use `lxc-user-nic` instead for the best performance.
To use `lxc-user-nic`, you need to edit [`/etc/lxc/lxc-usernet`](https://github.com/rootless-containers/rootlesskit/tree/v0.4.0#--netlxc-user-nic-experimental) and set `$DOCKERD_ROOTLESS_ROOTLESSKIT_NET=lxc-user-nic`.
To use `lxc-user-nic`, you need to edit [`/etc/lxc/lxc-usernet`](https://github.com/rootless-containers/rootlesskit/tree/v0.6.0#--netlxc-user-nic-experimental) and set `$DOCKERD_ROOTLESS_ROOTLESSKIT_NET=lxc-user-nic`.

4
hack/dockerfile/install/rootlesskit.installer
View file

@ -1,7 +1,7 @@
#!/bin/sh
# v0.4.1
ROOTLESSKIT_COMMIT=27a0c7a2483732b33d4192c1d178c83c6b9e202d
# v0.6.0
ROOTLESSKIT_COMMIT=2fcff6ceae968a1d895e6205e5154b107247356f
install_rootlesskit() {
case "$1" in