Skip to content
This repository has been archived by the owner on Oct 13, 2023. It is now read-only.

[19.03 backport] backport rootless fixes #208

Merged
merged 2 commits into from
May 14, 2019
Merged

[19.03 backport] backport rootless fixes #208

merged 2 commits into from
May 14, 2019

Conversation

thaJeztah
Copy link
Member

@AkihiroSuda @thaJeztah
rootless: optional support for lxc-user-nic SUID binary
e8b9a75 
lxc-user-nic can eliminate slirp overhead but needs /etc/lxc/lxc-usernet to be configured for the current user.

To use lxc-user-nic, $DOCKERD_ROOTLESS_ROOTLESSKIT_NET=lxc-user-nic also needs to be set.

This commit also bumps up RootlessKit from v0.3.0 to v0.4.0:
rootless-containers/rootlesskit@70e0502...e92d5e7

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
(cherry picked from commit 63a66b0)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
@AkihiroSuda @thaJeztah
dockerd: fix rootless detection (alternative to moby#39024)
8493fb1 
The `--rootless` flag had a couple of issues:
* moby#38702: euid=0, $USER="root" but no access to cgroup ("rootful" Docker in rootless Docker)
* moby#39009: euid=0 but $USER="docker" (rootful boot2docker)

To fix moby#38702, XDG dirs are ignored as in rootful Docker, unless the
dockerd is directly running under RootlessKit namespaces.

RootlessKit detection is implemented by checking whether `$ROOTLESSKIT_STATE_DIR` is set.

To fix moby#39009, the non-robust `$USER` check is now completely removed.

The entire logic can be illustrated as follows:

```
withRootlessKit := getenv("ROOTLESSKIT_STATE_DIR")
rootlessMode := withRootlessKit || cliFlag("--rootless")
honorXDG := withRootlessKit
useRootlessKitDockerProxy := withRootlessKit
removeCgroupSpec := rootlessMode
adjustOOMScoreAdj := rootlessMode
```

Close moby#39024
Fix moby#38702 moby#39009

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
(cherry picked from commit 3518383)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
@thaJeztah thaJeztah added this to the 19.03.0 milestone May 13, 2019
@thaJeztah
Copy link
Member Author

ping @AkihiroSuda @tonistiigi

@tiborvass tiborvass merged commit 03ce408 into docker-archive:19.03 May 14, 2019
@thaJeztah thaJeztah deleted the 19.03_backport_rootless_fixes branch May 14, 2019 01:56
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@tiborvass tiborvass tiborvass approved these changes

@tonistiigi tonistiigi tonistiigi approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
19.03.0
Development

Successfully merging this pull request may close these issues.
4 participants
@thaJeztah @tonistiigi @tiborvass @AkihiroSuda