Rootless Docker

Rootless Docker

Reduce attack surface

It is not…

• Running as non-root in container
• Enabling user namespace mapping

It is…

• Running dockerd as non-root
• Experimental preview in Docker 19.03
• See slides by Aikihiro Suda

–

Demo: Rootless Docker

Running Docker as unprivileged user

• Based on user namespaces (map UIDs to unprivileged range)
• Handling of namespaces is based on rootlesskit by Akihiro Suda
• Networking is based on moby/vpnkit

curl -sSL https://get.docker.com/rootless | sh

What does not work

• Only Ubuntu supports overlay fs
• Other distributions use vfs (not recommended for production)

Rootless Everything

Akihiro is also working on…

• Rootless kubernetes
• Rootless buildkit