Chris Binnie - Cloud Native Security

For rootless mode, however, the limitations are subtly different. In Table 2.1we can see some of the limitations.

Table 2.1: Rootless Mode Limitations and Restrictions

The contents of Table 2.1are not intended to put you off using rootless mode but instead give an insight into the lengths that the developers at Docker have had to go to in order to make this functionality a reality. There are unquestionably trade-offs, but that is almost always the case when security controls are introduced. You might have only one lock on the front door of your house, for example, but to be fully insurable your door probably needs two locks, which means paying for a second lock, fitting it, and carrying a second key with you when you have left the house.

To get started we need to download an installation script as supplied by Docker. It can be found at get.docker.com/rootlessand, as with all online content, the script should be read through to check for any security implications that you do not want to be exposed to before applying it. And, having read the comments at the top of the script, you need to run a diffcommand on the contents of the script github.com/docker/docker-install/blob/master/rootless-install.shbefore using the script at the other URL (choose the Raw option for the displayed format on GitHub for easy copying):

$ diff -y get-docker.sh install.sh

This Docker functionality is being actively developed, so if you have trouble with one version of the installation script, try the other, which might be a more stable version.

It should go without saying at this juncture that we do not need to be the rootuser for the running containers. As a result, at this stage we will become the chrisuser with this command:

$ sudo -i chris

Clearly, you should alter the username to suit your own needs, potentially using your nonprivileged login user.

We will run the slightly more stable get.docker.comversion of the script this way, saving it to install.shas a filename:

$ curl https://get.docker.com/rootless > install.sh

Now, make it executable and run the script:

$ chmod +x install.sh ; ./install.sh

After the short process is completed, you are greeted with Docker Engine client and server version information; for example, the client is installed as follows to match the server version:

Client: Docker Engine - Community Version: 19.03.12 API version: 1.40 Go version: go1.13.10

In Listing 2.1 we can see the tail end of the installation script's output.

Listing 2.1:Rootless Mode Docker Has Installed and Is Offering the User Information

# Docker binaries are installed in /home/chris/bin # WARN: dockerd is not in your current PATH or pointing to /home/chris/bin/dockerd # Make sure the following environment variables are set (or add them to ~/.bashrc): export PATH=/home/chris/bin:$PATH export DOCKER_HOST=unix:///home/chris/rootless/docker.sock # # To control docker service run: # systemctl --user (start|stop|restart) docker #

Take a look at the post-install advice in Listing 2.1. The binaries have been installed within your user's home directory under the bin/directory. You can confirm that they are there with an lscommand.

The next thing to do is create three environment variables, as follows:

$ export XDG_RUNTIME_DIR=/home/$USER/rootless $ export PATH=/home/$USER/bin:$PATH $ export DOCKER_HOST=unix:///home/$USER/rootless/docker.sock

In the previous examples, for ease, $USERis used in place of chris.

You can also specify a different directory name here if you prefer. Before running the next command, we will need a directory to store our running container content and configuration, so create one now:

$ mkdir rootless

Now we can run this command to get rootless mode going, noting that we are using the preferred overlay2storage driver:

$ bin/dockerd-rootless.sh --experimental --storage-driver overlay2

Listing 2.2 shows the end of the output, describing how /home/chris/rootless/docker.sockhas connected to Docker Engine in rootless mode.

Listing 2.2:Docker in Rootless Mode Has Run Successfully

WARN[2020-08-24T15:51:34.554236269+01:00] Not using native diff for overlay2, this may cause degraded performance for building images: failed to set opaque flag on middle layer: operation not permitted storage-driver=overlay2 INFO[2020-08-24T15:51:34.555462723+01:00] Docker daemon commit=48a66213fe graphdriver(s)=overlay2 version=19.03.12 INFO[2020-08-24T15:51:34.556309674+01:00] Daemon has completed initialization INFO[2020-08-24T15:51:34.602091497+01:00] API listen on /home/chris/rootless/docker.sock

If you run the following command, you will see the processes running for Docker, as the less privileged user:

$ ps -ef | grep docker

Listing 2.3 shows the results.

Listing 2.3:Rootless Mode Docker Processes Running in the Background

chris 9286 9213 0 15:51 pts/0 00:00:00 rootlesskit --net=vpnkit --mtu=1500 --slirp4netns-sandbox=auto --slirp4netns-seccomp=auto --disable-host-loopback --port-driver=builtin --copy-up=/etc --copy-up=/run bin/dockerd-rootless.sh --experimental --storage-driver overlay2 chris 9295 9286 0 15:51 pts/0 00:00:00 /proc/self/exe --net=vpnkit --mtu=1500 --slirp4netns-sandbox=auto --slirp4netns-seccomp=auto --disable-host-loopback --port-driver=builtin --copy-up=/etc --copy-up=/run bin/dockerd-rootless.sh --experimental --storage-driver overlay2 chris 9325 9295 0 15:51 pts/0 00:00:04 dockerd --experimental --storage-driver overlay2 chris 9343 9325 0 15:51 ? 00:00:03 containerd --config /home/chris/rootless/docker/containerd/containerd.toml --log-level info

To start a rootless mode container, we need to point Docker Engine precisely at where the Docker socket file is located. Within a second terminal, we will run the following commands to spawn a rootless Apache container: