github.com/jwhonce/docker@v0.6.7-0.20190327063223-da823cf3a5a3/contrib/dockerd-rootless.sh (about)

     1  #!/bin/sh
     2  # dockerd-rootless.sh executes dockerd in rootless mode.
     3  #
     4  # Usage: dockerd-rootless.sh --experimental [DOCKERD_OPTIONS]
     5  # Currently, specifying --experimental is mandatory.
     6  #
     7  # External dependencies:
     8  # * newuidmap and newgidmap needs to be installed.
     9  # * /etc/subuid and /etc/subgid needs to be configured for the current user.
    10  # * Either slirp4netns (v0.3+) or VPNKit needs to be installed.
    11  #
    12  # See the documentation for the further information.
    13  
    14  set -e -x
    15  if ! [ -w $XDG_RUNTIME_DIR ]; then
    16  	echo "XDG_RUNTIME_DIR needs to be set and writable"
    17  	exit 1
    18  fi
    19  if ! [ -w $HOME ]; then
    20  	echo "HOME needs to be set and writable"
    21  	exit 1
    22  fi
    23  
    24  rootlesskit=""
    25  for f in docker-rootlesskit rootlesskit; do
    26  	if which $f >/dev/null 2>&1; then
    27  		rootlesskit=$f
    28  		break
    29  	fi
    30  done
    31  if [ -z $rootlesskit ]; then
    32  	echo "rootlesskit needs to be installed"
    33  	exit 1
    34  fi
    35  
    36  net=""
    37  mtu=""
    38  if which slirp4netns >/dev/null 2>&1; then
    39  	if slirp4netns --help | grep -- --disable-host-loopback; then
    40  		net=slirp4netns
    41  		mtu=65520
    42  	else
    43  		echo "slirp4netns does not support --disable-host-loopback. Falling back to VPNKit."
    44  	fi
    45  fi
    46  if [ -z $net ]; then
    47  	if which vpnkit >/dev/null 2>&1; then
    48  		net=vpnkit
    49  		mtu=1500
    50  	else
    51  		echo "Either slirp4netns (v0.3+) or vpnkit needs to be installed"
    52  		exit 1
    53  	fi
    54  fi
    55  
    56  if [ -z $_DOCKERD_ROOTLESS_CHILD ]; then
    57  	_DOCKERD_ROOTLESS_CHILD=1
    58  	export _DOCKERD_ROOTLESS_CHILD
    59  	# Re-exec the script via RootlessKit, so as to create unprivileged {user,mount,network} namespaces.
    60  	#
    61  	# --copy-up allows removing/creating files in the directories by creating tmpfs and symlinks
    62  	# * /etc: copy-up is required so as to prevent `/etc/resolv.conf` in the
    63  	#         namespace from being unexpectedly unmounted when `/etc/resolv.conf` is recreated on the host
    64  	#         (by either systemd-networkd or NetworkManager)
    65  	# * /run: copy-up is required so that we can create /run/docker (hardcoded for plugins) in our namespace
    66  	$rootlesskit \
    67  		--net=$net --mtu=$mtu --disable-host-loopback \
    68  		--copy-up=/etc --copy-up=/run \
    69  		$DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS \
    70  		$0 $@
    71  else
    72  	[ $_DOCKERD_ROOTLESS_CHILD = 1 ]
    73  	# remove the symlinks for the existing files in the parent namespace if any,
    74  	# so that we can create our own files in our mount namespace.
    75  	rm -f /run/docker /run/xtables.lock
    76  	dockerd $@
    77  fi