github.com/docker/docker@v299999999.0.0-20200612211812-aaf470eca7b5+incompatible/contrib/dockerd-rootless.sh (about)

     1  #!/bin/sh
     2  # dockerd-rootless.sh executes dockerd in rootless mode.
     3  #
     4  # Usage: dockerd-rootless.sh [DOCKERD_OPTIONS]
     5  #
     6  # External dependencies:
     7  # * newuidmap and newgidmap needs to be installed.
     8  # * /etc/subuid and /etc/subgid needs to be configured for the current user.
     9  # * Either one of slirp4netns (>= v0.4.0), VPNKit, lxc-user-nic needs to be installed.
    10  #   slirp4netns is used by default if installed. Otherwise fallsback to VPNKit.
    11  #   The default value can be overridden with $DOCKERD_ROOTLESS_ROOTLESSKIT_NET=(slirp4netns|vpnkit|lxc-user-nic)
    12  #
    13  # See the documentation for the further information: https://docs.docker.com/engine/security/rootless/
    14  
    15  set -e -x
    16  if ! [ -w $XDG_RUNTIME_DIR ]; then
    17  	echo "XDG_RUNTIME_DIR needs to be set and writable"
    18  	exit 1
    19  fi
    20  if ! [ -w $HOME ]; then
    21  	echo "HOME needs to be set and writable"
    22  	exit 1
    23  fi
    24  
    25  rootlesskit=""
    26  for f in docker-rootlesskit rootlesskit; do
    27  	if which $f > /dev/null 2>&1; then
    28  		rootlesskit=$f
    29  		break
    30  	fi
    31  done
    32  if [ -z $rootlesskit ]; then
    33  	echo "rootlesskit needs to be installed"
    34  	exit 1
    35  fi
    36  
    37  : "${DOCKERD_ROOTLESS_ROOTLESSKIT_NET:=}"
    38  : "${DOCKERD_ROOTLESS_ROOTLESSKIT_MTU:=}"
    39  : "${DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SANDBOX:=auto}"
    40  : "${DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SECCOMP:=auto}"
    41  net=$DOCKERD_ROOTLESS_ROOTLESSKIT_NET
    42  mtu=$DOCKERD_ROOTLESS_ROOTLESSKIT_MTU
    43  if [ -z $net ]; then
    44  	if which slirp4netns > /dev/null 2>&1; then
    45  		# If --netns-type is present in --help, slirp4netns is >= v0.4.0.
    46  		if slirp4netns --help | grep -qw -- --netns-type; then
    47  			net=slirp4netns
    48  			if [ -z $mtu ]; then
    49  				mtu=65520
    50  			fi
    51  		else
    52  			echo "slirp4netns found but seems older than v0.4.0. Falling back to VPNKit."
    53  		fi
    54  	fi
    55  	if [ -z $net ]; then
    56  		if which vpnkit > /dev/null 2>&1; then
    57  			net=vpnkit
    58  		else
    59  			echo "Either slirp4netns (>= v0.4.0) or vpnkit needs to be installed"
    60  			exit 1
    61  		fi
    62  	fi
    63  fi
    64  if [ -z $mtu ]; then
    65  	mtu=1500
    66  fi
    67  
    68  if [ -z $_DOCKERD_ROOTLESS_CHILD ]; then
    69  	_DOCKERD_ROOTLESS_CHILD=1
    70  	export _DOCKERD_ROOTLESS_CHILD
    71  	# Re-exec the script via RootlessKit, so as to create unprivileged {user,mount,network} namespaces.
    72  	#
    73  	# --copy-up allows removing/creating files in the directories by creating tmpfs and symlinks
    74  	# * /etc: copy-up is required so as to prevent `/etc/resolv.conf` in the
    75  	#         namespace from being unexpectedly unmounted when `/etc/resolv.conf` is recreated on the host
    76  	#         (by either systemd-networkd or NetworkManager)
    77  	# * /run: copy-up is required so that we can create /run/docker (hardcoded for plugins) in our namespace
    78  	exec $rootlesskit \
    79  		--net=$net --mtu=$mtu \
    80  		--slirp4netns-sandbox=$DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SANDBOX \
    81  		--slirp4netns-seccomp=$DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SECCOMP \
    82  		--disable-host-loopback --port-driver=builtin \
    83  		--copy-up=/etc --copy-up=/run \
    84  		--propagation=rslave \
    85  		$DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS \
    86  		$0 $@
    87  else
    88  	[ $_DOCKERD_ROOTLESS_CHILD = 1 ]
    89  	# remove the symlinks for the existing files in the parent namespace if any,
    90  	# so that we can create our own files in our mount namespace.
    91  	rm -f /run/docker /run/xtables.lock
    92  	exec dockerd $@
    93  fi