Akihiro Suda f0b405fbda rootless: expose ports automatically

Now `docker run -p` ports can be exposed to the host namespace automatically when `dockerd-rootless.sh` is launched with
`--userland-proxy --userland-proxy-path $(which rootlesskit-docker-proxy)`.
This is akin to how Docker for Mac/Win works with `--userland-proxy-path=/path/to/vpnkit-expose-port`.

The port number on the host namespace needs to be set to >= 1024.
SCTP ports are currently unsupported.

RootlessKit changes: 7bbbc48a6f...ed26714429

Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>

2019-03-21 02:44:08 +09:00

3.4 KiB

Raw Blame History

Rootless mode (Experimental)

The rootless mode allows running dockerd as an unprivileged user, using user_namespaces(7), mount_namespaces(7), network_namespaces(7).

No SETUID/SETCAP binary is required except newuidmap and newgidmap.

Requirements

newuidmap and newgidmap need to be installed on the host. These commands are provided by the uidmap package on most distros.
/etc/subuid and /etc/subgid should contain >= 65536 sub-IDs. e.g. penguin:231072:65536.

$ id -u
1001
$ whoami
penguin
$ grep ^$(whoami): /etc/subuid
penguin:231072:65536
$ grep ^$(whoami): /etc/subgid
penguin:231072:65536

Either slirp4netns (v0.3+) or VPNKit needs to be installed. slirp4netns is preferred for the best performance.

Distribution-specific hint

Debian (excluding Ubuntu)

sudo sh -c "echo 1 > /proc/sys/kernel/unprivileged_userns_clone" is required

Arch Linux

sudo sh -c "echo 1 > /proc/sys/kernel/unprivileged_userns_clone" is required

openSUSE

sudo modprobe ip_tables iptable_mangle iptable_nat iptable_filter is required. (This is likely to be required on other distros as well)

RHEL/CentOS 7

sudo sh -c "echo 28633 > /proc/sys/user/max_user_namespaces" is required
COPR package vbatts/shadow-utils-newxidmap needs to be installed

Restrictions

Only vfs graphdriver is supported. However, on Ubuntu and a few distros, overlay2 and overlay are also supported.
Following features are not supported:
- Cgroups (including docker top, which depends on the cgroups device controller)
- Apparmor
- Checkpoint
- Overlay network
- Exposing SCTP ports
To expose a TCP/UDP port, the host port number needs to be set to >= 1024.

Usage

Daemon

You need to run dockerd-rootless.sh instead of dockerd.

$ dockerd-rootless.sh --experimental --userland-proxy --userland-proxy-path=$(which rootlesskit-docker-proxy)"

As Rootless mode is experimental per se, currently you always need to run dockerd-rootless.sh with --experimental. Also, to expose ports, you need to set --userland-proxy-path to the path of rootlesskit-docker-proxy binary.

Remarks:

The socket path is set to $XDG_RUNTIME_DIR/docker.sock by default. $XDG_RUNTIME_DIR is typically set to /run/user/$UID.
The data dir is set to ~/.local/share/docker by default.
The exec dir is set to $XDG_RUNTIME_DIR/docker by default.
The daemon config dir is set to ~/.config/docker (not ~/.docker, which is used by the client) by default.
The dockerd-rootless.sh script executes dockerd in its own user, mount, and network namespaces. You can enter the namespaces by running nsenter -U --preserve-credentials -n -m -t $(cat $XDG_RUNTIME_DIR/docker.pid).

Client

You can just use the upstream Docker client but you need to set the socket path explicitly.

$ docker -H unix://$XDG_RUNTIME_DIR/docker.sock run -d nginx

Routing ping packets

To route ping packets, you need to set up net.ipv4.ping_group_range properly as the root.

$ sudo sh -c "echo 0   2147483647  > /proc/sys/net/ipv4/ping_group_range"

3.4 KiB Raw Blame History