github.com/docker/docker@v299999999.0.0-20200612211812-aaf470eca7b5+incompatible/contrib/dockerd-rootless.sh (about) 1 #!/bin/sh 2 # dockerd-rootless.sh executes dockerd in rootless mode. 3 # 4 # Usage: dockerd-rootless.sh [DOCKERD_OPTIONS] 5 # 6 # External dependencies: 7 # * newuidmap and newgidmap needs to be installed. 8 # * /etc/subuid and /etc/subgid needs to be configured for the current user. 9 # * Either one of slirp4netns (>= v0.4.0), VPNKit, lxc-user-nic needs to be installed. 10 # slirp4netns is used by default if installed. Otherwise fallsback to VPNKit. 11 # The default value can be overridden with $DOCKERD_ROOTLESS_ROOTLESSKIT_NET=(slirp4netns|vpnkit|lxc-user-nic) 12 # 13 # See the documentation for the further information: https://docs.docker.com/engine/security/rootless/ 14 15 set -e -x 16 if ! [ -w $XDG_RUNTIME_DIR ]; then 17 echo "XDG_RUNTIME_DIR needs to be set and writable" 18 exit 1 19 fi 20 if ! [ -w $HOME ]; then 21 echo "HOME needs to be set and writable" 22 exit 1 23 fi 24 25 rootlesskit="" 26 for f in docker-rootlesskit rootlesskit; do 27 if which $f > /dev/null 2>&1; then 28 rootlesskit=$f 29 break 30 fi 31 done 32 if [ -z $rootlesskit ]; then 33 echo "rootlesskit needs to be installed" 34 exit 1 35 fi 36 37 : "${DOCKERD_ROOTLESS_ROOTLESSKIT_NET:=}" 38 : "${DOCKERD_ROOTLESS_ROOTLESSKIT_MTU:=}" 39 : "${DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SANDBOX:=auto}" 40 : "${DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SECCOMP:=auto}" 41 net=$DOCKERD_ROOTLESS_ROOTLESSKIT_NET 42 mtu=$DOCKERD_ROOTLESS_ROOTLESSKIT_MTU 43 if [ -z $net ]; then 44 if which slirp4netns > /dev/null 2>&1; then 45 # If --netns-type is present in --help, slirp4netns is >= v0.4.0. 46 if slirp4netns --help | grep -qw -- --netns-type; then 47 net=slirp4netns 48 if [ -z $mtu ]; then 49 mtu=65520 50 fi 51 else 52 echo "slirp4netns found but seems older than v0.4.0. Falling back to VPNKit." 53 fi 54 fi 55 if [ -z $net ]; then 56 if which vpnkit > /dev/null 2>&1; then 57 net=vpnkit 58 else 59 echo "Either slirp4netns (>= v0.4.0) or vpnkit needs to be installed" 60 exit 1 61 fi 62 fi 63 fi 64 if [ -z $mtu ]; then 65 mtu=1500 66 fi 67 68 if [ -z $_DOCKERD_ROOTLESS_CHILD ]; then 69 _DOCKERD_ROOTLESS_CHILD=1 70 export _DOCKERD_ROOTLESS_CHILD 71 # Re-exec the script via RootlessKit, so as to create unprivileged {user,mount,network} namespaces. 72 # 73 # --copy-up allows removing/creating files in the directories by creating tmpfs and symlinks 74 # * /etc: copy-up is required so as to prevent `/etc/resolv.conf` in the 75 # namespace from being unexpectedly unmounted when `/etc/resolv.conf` is recreated on the host 76 # (by either systemd-networkd or NetworkManager) 77 # * /run: copy-up is required so that we can create /run/docker (hardcoded for plugins) in our namespace 78 exec $rootlesskit \ 79 --net=$net --mtu=$mtu \ 80 --slirp4netns-sandbox=$DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SANDBOX \ 81 --slirp4netns-seccomp=$DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SECCOMP \ 82 --disable-host-loopback --port-driver=builtin \ 83 --copy-up=/etc --copy-up=/run \ 84 --propagation=rslave \ 85 $DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS \ 86 $0 $@ 87 else 88 [ $_DOCKERD_ROOTLESS_CHILD = 1 ] 89 # remove the symlinks for the existing files in the parent namespace if any, 90 # so that we can create our own files in our mount namespace. 91 rm -f /run/docker /run/xtables.lock 92 exec dockerd $@ 93 fi