Docker rootless - Revision history

Remco at 15:18, 1 March 2023

2023-03-01T15:18:45Z

← Older revision		Revision as of 15:18, 1 March 2023
Line 3:		Line 3:
	We have made it possible to run docker containers rootless now. Ie. as a normal user, without root access (for in depth info see: https://docs.docker.com/engine/security/rootless).		We have made it possible to run docker containers rootless now. Ie. as a normal user, without root access (for in depth info see: https://docs.docker.com/engine/security/rootless).

	You need to prepare your system:		You need to prepare your system. Follow the instructions given by:
	$ dockerd-rootless-setuptool.sh		$ dockerd-rootless-setuptool.sh

	By default this will store docker images in <kbd>~/.local/share/docker</kbd>. Unfortunately this does not work correctly with a network mounted homedisk. There are 2 ways of resolving this, ~~but~~ only ~~use~~ one of them, because they conflict with each other.<br>		By default this will store docker images in <kbd>~/.local/share/docker</kbd>. Unfortunately this does not work correctly with a network mounted homedisk. There are 2 ways of resolving this, use only one of them, because they conflict with each other.<br>

	'''Solution 1'''<br>		'''Solution 1'''<br>

	To solve this you need to find a suitable location on your local disk to store files. Usually <kbd>/mnt/D/<subdir></kbd> or <kbd>/var/tmp/<subdir></kbd> are good choices.		To solve this you need to find a suitable location on your local disk to store files. Usually <kbd>/mnt/D/<subdir></kbd> or <kbd>/var/tmp/<subdir></kbd> are good choices.
	You set this by editing the <kbd>data-root</kbd> in <kbd>~/.config/docker/daemon.json</kbd>. Example:		You set this by editing the <kbd>data-root</kbd> in <kbd>~/.config/docker/daemon.json</kbd>. That file and directory may not (yet) exist. Example:
			$ [ -d ~/.config/docker ] \|\| mkdir -p ~/.config/docker
	$ edit ~/.config/docker/daemon.json to contain:		$ edit ~/.config/docker/daemon.json to contain:
	{		{

Remco at 09:28, 1 March 2023

2023-03-01T09:28:11Z

← Older revision		Revision as of 09:28, 1 March 2023
Line 10:		Line 10:
	'''Solution 1'''<br>		'''Solution 1'''<br>

	To solve this you need to find a suitable location on your local disk to store files. Usually <kbd>/mnt/D/<subdir></kbd> or <kbd>/var/tmp/<subdir></kbd> are ~~goot~~ choices.		To solve this you need to find a suitable location on your local disk to store files. Usually <kbd>/mnt/D/<subdir></kbd> or <kbd>/var/tmp/<subdir></kbd> are good choices.
	You set this by editing the <kbd>data-root</kbd> in <kbd>~/.config/docker/daemon.json</kbd>. Example:		You set this by editing the <kbd>data-root</kbd> in <kbd>~/.config/docker/daemon.json</kbd>. Example:
	$ edit ~/.config/docker/daemon.json to contain:		$ edit ~/.config/docker/daemon.json to contain:

Remco at 13:15, 11 January 2023

2023-01-11T13:15:38Z

← Older revision		Revision as of 13:15, 11 January 2023
Line 28:		Line 28:
	$ mkfs.ext4 -E root_owner -m0 -L docker ~/.docker.img		$ mkfs.ext4 -E root_owner -m0 -L docker ~/.docker.img
	$ chmod 755 ~/.local/share		$ chmod 755 ~/.local/share
			$ nfs4_setfacl -a 'A::nobody@rug.nl:X' ~/.local ~/local/share
	Now you need to make sure this disk image is mounted when you login. For that you need to edit <kbd>~/.pam_mount.conf.xml</kbd> to contain:		Now you need to make sure this disk image is mounted when you login. For that you need to edit <kbd>~/.pam_mount.conf.xml</kbd> to contain:

Remco at 09:25, 30 September 2022

2022-09-30T09:25:55Z

← Older revision		Revision as of 09:25, 30 September 2022
Line 28:		Line 28:
	$ mkfs.ext4 -E root_owner -m0 -L docker ~/.docker.img		$ mkfs.ext4 -E root_owner -m0 -L docker ~/.docker.img
	$ chmod 755 ~/.local/share		$ chmod 755 ~/.local/share
	Now you need to make sure this disk image is mounted when you login. For that you need to edit		Now you need to make sure this disk image is mounted when you login. For that you need to edit <kbd>~/.pam_mount.conf.xml</kbd> to contain:
	~~$ edit~~ ~/.pam_mount.conf.xml to contain:
	<?xml version="1.0" encoding="utf-8" ?>		<?xml version="1.0" encoding="utf-8" ?>
	<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">		<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">

Remco at 09:23, 30 September 2022

2022-09-30T09:23:47Z

← Older revision		Revision as of 09:23, 30 September 2022
Line 10:		Line 10:
	'''Solution 1'''<br>		'''Solution 1'''<br>

	To solve this you need to find a suitable location on your local disk to store files. Usually <kbd>/mnt/D</kbd> ~~is a good location~~.		To solve this you need to find a suitable location on your local disk to store files. Usually <kbd>/mnt/D/<subdir></kbd> or <kbd>/var/tmp/<subdir></kbd> are goot choices.
	You set this by editing the <kbd>data-root</kbd> in <kbd>~/.config/docker/daemon.json</kbd>. Example:		You set this by editing the <kbd>data-root</kbd> in <kbd>~/.config/docker/daemon.json</kbd>. Example:
	$ edit ~/.config/docker/daemon.json to contain:		$ edit ~/.config/docker/daemon.json to contain:
	{		{
	"data-root": "/mnt/D"		"data-root": "/mnt/D/<subdir>"
	}		}
	$ systemctl --user restart docker		$ systemctl --user restart docker

Remco at 14:05, 16 September 2022

2022-09-16T14:05:58Z

← Older revision		Revision as of 14:05, 16 September 2022
Line 22:		Line 22:
	'''Solution 2'''<br>		'''Solution 2'''<br>

	An alternative approach is to store a small ext4 formatted diskimage in your homedir:		An alternative approach (make sure to remove <kbd>~/.config/docker/daemon.json</kbd> when you do this!) is to store a small ext4 formatted diskimage in your homedir and make it mountable:
	$ truncate -s 25G ~/.docker.img		$ truncate -s 25G ~/.docker.img
	$ nfs4_setfacl -a 'A::nobody@rug.nl:X' ~		$ nfs4_setfacl -a 'A::nobody@rug.nl:X' ~
Line 28:		Line 28:
	$ mkfs.ext4 -E root_owner -m0 -L docker ~/.docker.img		$ mkfs.ext4 -E root_owner -m0 -L docker ~/.docker.img
	$ chmod 755 ~/.local/share		$ chmod 755 ~/.local/share
	Now you need to make sure this disk image is mounted when you login:		Now you need to make sure this disk image is mounted when you login. For that you need to edit
	$ ~~cat~~ ~/.pam_mount.conf.xml ~~<<EOF~~		$ edit ~/.pam_mount.conf.xml to contain:
	<?xml version="1.0" encoding="utf-8" ?>		<?xml version="1.0" encoding="utf-8" ?>
	<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">		<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">
Line 35:		Line 35:
	<volume fstype="ext4" mountpoint="~/.local/share/docker" options="async,nosuid,loop,exec,noatime,nodev" path="~/.docker.img" />		<volume fstype="ext4" mountpoint="~/.local/share/docker" options="async,nosuid,loop,exec,noatime,nodev" path="~/.docker.img" />
	</pam_mount>		</pam_mount>
	~~EOF~~
	Then logout and login again (or do <kbd>ssh 127.0.0.1 exit</kbd>)		Then logout and login again (or do <kbd>ssh 127.0.0.1 exit</kbd>)

Remco at 14:03, 16 September 2022

2022-09-16T14:03:40Z

← Older revision		Revision as of 14:03, 16 September 2022
Line 12:		Line 12:
	To solve this you need to find a suitable location on your local disk to store files. Usually <kbd>/mnt/D</kbd> is a good location.		To solve this you need to find a suitable location on your local disk to store files. Usually <kbd>/mnt/D</kbd> is a good location.
	You set this by editing the <kbd>data-root</kbd> in <kbd>~/.config/docker/daemon.json</kbd>. Example:		You set this by editing the <kbd>data-root</kbd> in <kbd>~/.config/docker/daemon.json</kbd>. Example:
	$ ~~d=/mnt/D/docker; f=~~~/.config/docker/daemon.json		$ edit ~/.config/docker/daemon.json to contain:
	~~$ mkdir -p $d~~		{
	~~$ echo "$((cat $f \|\| echo {}) \| jq '.~~"data-root" = "~~'$d'~~"~~')" > $f~~		"data-root": "/mnt/D"
			}
	$ systemctl --user restart docker		$ systemctl --user restart docker

	~~You can also edit this file with a text editor.~~

	'''Solution 2'''<br>		'''Solution 2'''<br>

Lwpadmin at 13:05, 28 April 2022

2022-04-28T13:05:52Z

← Older revision		Revision as of 13:05, 28 April 2022
Line 5:		Line 5:
	You need to prepare your system:		You need to prepare your system:
	$ dockerd-rootless-setuptool.sh		$ dockerd-rootless-setuptool.sh
	By default this will store docker images in <kbd>~/.local/share/docker</kbd>. Unfortunately this does not work correctly with a network mounted homedisk. To solve this you need to find a suitable location on your local disk to store files. Usually <kbd>/mnt/D</kbd> is a good location.
			By default this will store docker images in <kbd>~/.local/share/docker</kbd>. Unfortunately this does not work correctly with a network mounted homedisk. There are 2 ways of resolving this, but only use one of them, because they conflict with each other.<br>

			'''Solution 1'''<br>

			To solve this you need to find a suitable location on your local disk to store files. Usually <kbd>/mnt/D</kbd> is a good location.
	You set this by editing the <kbd>data-root</kbd> in <kbd>~/.config/docker/daemon.json</kbd>. Example:		You set this by editing the <kbd>data-root</kbd> in <kbd>~/.config/docker/daemon.json</kbd>. Example:
	$ d=/mnt/D/docker; f=~/.config/docker/daemon.json		$ d=/mnt/D/docker; f=~/.config/docker/daemon.json
Line 13:		Line 18:

	You can also edit this file with a text editor.		You can also edit this file with a text editor.

			'''Solution 2'''<br>

	An alternative approach is to store a small ext4 formatted diskimage in your homedir:		An alternative approach is to store a small ext4 formatted diskimage in your homedir:

Remco: Clarify when you can use the standard docker

2022-04-20T12:36:29Z

Clarify when you can use the standard docker

← Older revision		Revision as of 12:36, 20 April 2022
Line 39:		Line 39:
	== Standard docker installation ==		== Standard docker installation ==

	It is still possible to request a standard docker installation (ie. the docker daemon runs as root).		It is still possible to request a standard docker installation (ie. the docker daemon runs as root) for your personal LWP (ie. not for any shared system such as systems in the computer labs or https://vlwp.rug.nl).

	=== Personal use: ===		=== Personal use: ===

Remco: Fixed a small error in the description

2022-04-20T12:34:19Z

Fixed a small error in the description

← Older revision		Revision as of 12:34, 20 April 2022
Line 19:		Line 19:
	$ nfs4_setfacl -a 'A::nobody@rug.nl:RWX' ~/.docker.img		$ nfs4_setfacl -a 'A::nobody@rug.nl:RWX' ~/.docker.img
	$ mkfs.ext4 -E root_owner -m0 -L docker ~/.docker.img		$ mkfs.ext4 -E root_owner -m0 -L docker ~/.docker.img
			$ chmod 755 ~/.local/share
	Now you need to make sure this disk image is mounted when you login:		Now you need to make sure this disk image is mounted when you login:
	$ cat ~/.pam_mount.conf <<EOF		$ cat ~/.pam_mount.conf.xml <<EOF
	<?xml version="1.0" encoding="utf-8" ?>		<?xml version="1.0" encoding="utf-8" ?>
	<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">		<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">