github.com/demonoid81/containerd@v1.3.4/docs/rootless.md (about)

     1  # Running containerd as a non-root user
     2  
     3  A non-root user can execute containerd by using [`user_namespaces(7)`](http://man7.org/linux/man-pages/man7/user_namespaces.7.html).
     4  
     5  For example [RootlessKit](https://github.com/rootless-containers/rootlesskit) can be used for setting up a user namespace (along with mount namespace and optionally network namespace). Please refer to RootlessKit documentation for further information.
     6  
     7  ## Daemon
     8  
     9  ```console
    10  $ rootlesskit --net=slirp4netns --copy-up=/etc \
    11    --state-dir=/run/user/1001/rootlesskit-containerd \
    12    containerd -c config.toml
    13  ```
    14  
    15  * `--net=slirp4netns --copy-up=/etc` is only required when you want to unshare network namespaces
    16  * Depending on the containerd plugin configuration, you may also need to add more `--copy-up` options, e.g. `--copy-up=/run`, which mounts a writable tmpfs on `/run`, with symbolic links to the files under the `/run` on the parent namespace.
    17  * `--state-dir` is set to a random directory under `/tmp` if unset. RootlessKit writes the PID to a file named `child_pid` under this directory.
    18  * You need to provide `config.toml` with your own path configuration. e.g.
    19  ```toml
    20  root = "/home/penguin/.local/share/containerd"
    21  state = "/run/user/1001/containerd"
    22  
    23  [grpc]
    24    address = "/run/user/1001/containerd/containerd.sock"
    25  
    26  [plugins]
    27    [plugins.linux]
    28      runtime_root = "/run/user/1001/containerd/runc"
    29  ```
    30  
    31  ## Client
    32  
    33  A client program such as `ctr` also needs to be executed inside the daemon namespaces.
    34  ```console
    35  $ nsenter -U --preserve-credentials -m -n -t $(cat /run/user/1001/rootlesskit-containerd/child_pid)
    36  $ export CONTAINERD_SNAPSHOTTER=native
    37  $ ctr -a /run/user/1001/containerd/containerd.sock pull docker.io/library/ubuntu:latest
    38  $ ctr -a /run/user/1001/containerd/containerd.sock run -t --rm --fifo-dir /tmp/foo-fifo --cgroup "" docker.io/library/ubuntu:latest foo
    39  ```
    40  
    41  * `overlayfs` snapshotter does not work inside user namespaces, except on Ubuntu kernel