Install Rootless Docker Kit and Run Rootless Container Mode

This guide teaches how to use Rootlesskit and Docker to install a Rootless Docker and run Docker containers in Rootless mode. The setup works for Linux (Ubuntu, Debian, etc.), and Raspberry PI Docker allows you to create Rootless containers. This means, Docker Engine will create and run these containers in Rootless mode. They will run as unprivileged to the user namespaces creating them.

You will learn different ways to get Rootless container ready:

• Using Docker Engine
• Using Rootlesskit

Docker and Rootlesskit allow you to create these rootless containers. Rootlesskit must be installed if you want Docker to inherit Rootless mode. Actually, Docker Daemon will need root-level access on the host system. Rootlesskit will then run containers as normal users. In this guide, you will learn:

• How to use rootlesskit to install rootless Docker Daemon.
• When you need to use Docker Rootless Mode.
• The advantages and limitations of Docker Rootless containers.
• How to use the installed rootlesskit and run Docker containers on Rootless Mode.
• How to Expose Privileged Ports with Rootless Docker (ports below 1024).
• Use Cases for Running Rootless Docker Containers.
• How to Uninstall rootlesskit and remove Docker Rootless Mode.

Step 1: Prerequisites to Rootlesskit and Rootless Docker

Before diving into this Docker Rootless guide:

• Ensure you have a working knowledge of Docker.
• Have Linux (Ubuntu, Debian, etc.) OS ready.
• Know how to install Docker Engine on Linux.

Related: How to Install Docker and Portainer on Ubuntu 22.04|20.04 18.04

Step 2: Setting Up Docker Rootless Environment

Before installing Docker as Rootless, you must first install Docker Engine itself. Follow these steps:

First, you need to ensure Docker is now available in your system.

• Ensure you have updated your package index:

sudo apt update
sudo apt upgrade -y

• Uninstall any Docker-related packages using the following command:

sudo apt remove docker docker-engine docker.io containerd runc

If you don’t have Docker, expect Unable to locate package docker-engine as the Output.

• Goa ahead and run the following command to create a Docker signed-by repository key and ensure needed dependencies are ready:

# Install necessary packages
sudo apt-get install ca-certificates curl
# Create a directory to store the Docker GPG key
sudo install -m 0755 -d /etc/apt/keyrings
# Download the Docker GPG key to the keyring directory
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
# Add permissions for the downloaded Docker GPG key
sudo chmod a+r /etc/apt/keyrings/docker.asc

• You can now add a Docker repository to Apt sources on your system:

sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"

• Install Docker and all plugins you like like Docker Compose:

sudo apt-get update
sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

• Check the Docker you have installed (Together with Docker compose)

sudo docker --version
docker compose version

• Now, make sure this Docker Engine is correctly installed by checking its running status:

sudo systemctl docker status

You must have Docker ready before proceeding to the next step. If you had challenges setting up Docker. Check Docker docs and learn how to install a Docker Engine.

Step 3: Installing Rootless Docker using Docker (With Rootlesskit)

docker.io is the Official Docker Engine maintainer. Let’s see the steps you need to Get docker.io to run Docker as Rootless.

Before adding Docker as Rootless, you must ensure the running Docker engine is disabled and it’s not running:

sudo systemctl disable --now docker.service docker.socket

• Ensure you have uidmap dependency ready to manage user namespace:

sudo apt-get install uidmap -y

• Go ahead and use Docker Community (docker-ce) to get Docker Rootless ready using curl:

curl -fsSL https://get.docker.com/rootless | sh

Note that Rootlesskit should be ready here.

Docker should be ready in Rootless mode

• Check the following paths and copy them (These paths are visible and the end of the above curl Output)

My paths are as follows:

export PATH=/home/ubuntu/bin:$PATH
export DOCKER_HOST=unix:///run/user/1000/docker.sock

Make sure you only copy your paths as the $user with the Linux user on your machine.

A Rootless Docker container will use these paths as a pair of environment variables to run your Rootless Docker Mode. Go ahead and open the .bashrc file with your editor and add your Rootless paths:

nano ~/.bashrc
vi ~/.bashrc

If you’re using ZSH, use the .zshrc file.

Now, Add your paths and save your file:

Step 4: How to Run A Docker Container Rootless Mode

You Rootless Docker set up ready. Make sure the Docker Daemon is really Rootless:

systemctl --user start docker

Run the following command to let your system always start your rootless Docker Engine at startup:

systemctl --user enable docker

Then check Rootless Docker status:

systemctl --user status docker

Now it’s time to run your first Rootless Mode container. I will use a simple example to make this guide short.

Consider creating an Apache web server. With Docker, you will deploy a Docker Container. With Docker as Rootless Mode, you will create containers as you would in the privileged Docker setup.

Go ahead and Use docker run as such:

docker run --name apache-container -p 8080:80 -d httpd:latest

Your Rootless Docker will create your container without touching root privileges. Check if the container is running:

docker ps

Now, you can access the running Docker container or Rootless mode using port 8080 (http://server_ip:8080/):

But Note: With a Rootless container, Docker won’t allow you to create ports below. Check the next sections to learn why.

Step 5: How to Manage Docker Container Running on Rootless Mode

If you have worked with Docker before, any Docker command should work on this container. The only difference here is root privileges.

This means any Docker command will work while you manage your Rootless container, for example:

• Stopping and removing a container:

# To stop the container
docker stop apache-container
# To remove the container  
docker rm apache-container

• List all available Docker containers:

docker ps -a

• Inspect container details by the container name or ID:

docker inspect apache-container

Step 6: Configuring Rootless Docker container

Sometimes you need to spice up your Rootless containers. For example, a Rootless Docker Engine can’t create and Expose Privileged Ports (any port below 1024). This means, Docker will always Expose ports above 1024.

Let’s check some management commands:

• Run a rootless Docker inside the root Docker. Consider you have a regular Docker running on your system. You will need:

1. Runs a Docker container with the name dind-rootless using the docker:<version>-dind-rootless image.
2. Use the --privileged flag to give extended privileges to the container. This way, the container will run in Rootless mode and perform tasks that would otherwise be restricted.

docker run -d --name dind-rootless --privileged docker:20.10-dind-rootless

• If you want to send Ping Packet Routing to a Rootless Docker container, you will need:

1. Add configuration to allow ping packet routing within the Docker containers:

2. In this case, you will Open the /etc/sysctl.conf file:

nano /etc/sysctl.conf

3. Add the following line:

net.ipv4.ping_group_range = 0 2147483647

4. Apply the changed file to allow ping packet routing:

sudo sysctl --system

• Exposing Privileged Ports with Rootless Docker. You can bind to privileged ports (ports below 1024) even when running as a non-root user. However, you need to:

1. Set the CAP_NET_BIND_SERVICE capability on the Rootlesskit binary:

sudo setcap cap_net_bind_service=ep $(which rootlesskit)

2. Restart the Docker service to apply the changes:

systemctl --user restart docker

Step 7: How to Uninstall Rootlesskit and remove Docker Rootless Mode

If you do want to Uninstall the Rootlesskit for this Rootless Mode, check the following steps:

• Stop the running Docker instance:

systemctl --user stop docker

Remove the installed Rootlesskit kit file:

rm -f /home/ubuntu/bin/dockerd

• Check the Docker status, and it should be dead:

systemctl --user status docker

• Check and Identify all installed Docker packages

dpkg -l | grep -i docker

• Next, remove all the above Docker-related packages and Purge them:

# Remove Docker-related packages
sudo apt-get purge -y docker-engine docker docker.io docker-ce docker-ce-cli docker-compose-plugin docker-ce-rootless-extras
# Purge Docker-related packages and dependencies
sudo apt-get autoremove -y --purge docker-engine docker docker.io docker-ce docker-compose-plugin docker-ce-rootless-extras

• Now, delete all images, containers, and volume files available in your Docker setup:

# Remove Docker data directory
sudo rm -rf /var/lib/docker
# Docker configuration directory
sudo rm -rf /etc/docker
# Docker socket file
sudo rm -rf /var/run/docker.sock

• Finally, confirm Docker Rootless and Docker Engine are completely removed:

sudo apt remove docker docker-engine docker.io containerd runc

• Open .bashrc and remove your added files:

nano ~/.bashrc
export PATH=/home/ubuntu/bin:$PATH
export DOCKER_HOST=unix:///run/user/1000/docker.sock

Step 8: Use Cases for Running Rootless Docker Containers

Where is this Rootless setup helpful? Well

• Rootless Docker creates a Shared Development Environments. This way, users create containers on shared servers with no impact on shared users.
• You don’t need to host multiple users on the same server. Rootless Docker containers don’t need user privileges. This means you won’t run separate server instances for each user. That is a cost-saving approach.
• Rootless Docker Containers
• If your Host plan needs, root access, rootless Docker doesn’t need root access and you will overcome this hosting limitation.

Step 9: The Limitations of Using Rootless Docker Container Mode

• Rootlesskit doesn’t support features like AppArmor, SCTP ports, and overlay network, just to name a few.
• You can’t use Cgroup. It’s only available if Docker is running with systemd that need root access.
• without Cgroup and systemd you won’t be able to use options such as –pids-limit, –memory, and –cpus.
• Storage Drivers like fuse-overlayfs, overlay2, and vfs get limited.
• You can run a Rootless container on privileged ports (ports below 1024).

Conclusion

This guide taught you how to perfectly use Docker and Rootlesskit to Install Rootless Docker and run a container on Rootless mode. You have learned:

• How to use rootlesskit to install rootless Docker Daemon.
• When you need to use Docker Rootless Mode.
• The advantages and limitations of Docker Rootless containers.
• How to use the installed rootlesskit and run Docker containers on Rootless Mode.
• How to Expose Privileged Ports with Rootless Docker (ports below 1024).
• Use Cases for Running Rootless Docker Containers.
• How to Uninstall rootlesskit and remove Docker Rootless Mode.