Skip to content

add dockerd-rootless-setuptool#40924

Closed
AkihiroSuda wants to merge 1 commit into
moby:masterfrom
AkihiroSuda:dockerd-rootless-setuptool
Closed

add dockerd-rootless-setuptool#40924
AkihiroSuda wants to merge 1 commit into
moby:masterfrom
AkihiroSuda:dockerd-rootless-setuptool

Conversation

@AkihiroSuda

@AkihiroSuda AkihiroSuda commented May 7, 2020 •
edited
Loading

Copy link
Copy Markdown
Member

- What I did

Added contrib/dockerd-rootless-setuptool.

The tool is expected to be used by https://get.docker.com/rootless script.

Can be included in RPM/DPKG packages as well.

Fix #40707
Relates to #40761

- How I did it
Rewrote https://get.docker.com/rootless in Go except the curl stuff.
The curl stuff is expected to be kept in https://get.docker.com/rootless .

Also, the storage driver is not detected in the new tool because the daemon should be able to choose overlay2/fuse-overlayfs/vfs automatically.

- How to verify it

$ dockerd-rootless-setuptool --help
A setup tool for dockerd-rootless.sh. Requires dockerd-rootless.sh to be present in $PATH. See https://docs.docker.com/engine/security/rootless/ for the usage.

Usage:
   [command]

Available Commands:
  check       Check prerequisites
  help        Help about any command
  setup       Setup systemd (if available) and show how to run rootless Docker

Flags:
  -h, --help             help for this command
      --ignore-rootful   ignore rootful Docker (/var/run/docker.sock)
      --skip-iptables    ignore mising iptables

Use " [command] --help" for more information about a command.

$ dockerd-rootless-setuptool setup
FATA[0000] Aborting because rootful Docker (/var/run/docker.sock) is running and accessible. Set --ignore-rootful to ignore.

$ dockerd-rootless-setuptool setup --ignore-rootful
INFO[0000] Installing systemd unit file /home/suda/.config/systemd/user/docker.service 
INFO[0000] + systemctl --user daemon-reload             
INFO[0000] + systemctl --user --no-pager --full status docker.service 
● docker.service - Docker Application Container Engine (Rootless)
     Loaded: loaded (/home/suda/.config/systemd/user/docker.service; disabled; vendor preset: enabled)
     Active: inactive (dead)
       Docs: https://docs.docker.com/engine/security/rootless/
...
INFO[0000] Starting docker.service                      
INFO[0000] + systemctl --user start docker.service      
INFO[0000] + systemctl --user --no-pager --full status docker.service 
● docker.service - Docker Application Container Engine (Rootless)
     Loaded: loaded (/home/suda/.config/systemd/user/docker.service; disabled; vendor preset: enabled)
     Active: active (running) since Thu 2020-05-07 22:39:11 JST; 31ms ago
       Docs: https://docs.docker.com/engine/security/rootless/
   Main PID: 32487 (rootlesskit)
     Memory: 1.6M
     CGroup: /user.slice/user-1001.slice/[email protected]/docker.service
             └─32487 rootlesskit --net=slirp4netns --mtu=65520 --slirp4netns-sandbox=auto --slirp4netns-seccomp=auto --disable-host-loopback --port-driver=builtin --copy-up=/etc --copy-up=/run --propagation=rslave /usr/local/bin/dockerd-rootless.sh

May 07 22:39:11 suda-ws01 dockerd-rootless.sh[32497]: --disable-host-loopback  prohibit connecting to 127.0.0.1:* on the host namespace
May 07 22:39:11 suda-ws01 dockerd-rootless.sh[32487]: + net=slirp4netns
May 07 22:39:11 suda-ws01 dockerd-rootless.sh[32487]: + [ -z ]
May 07 22:39:11 suda-ws01 dockerd-rootless.sh[32487]: + mtu=65520
May 07 22:39:11 suda-ws01 dockerd-rootless.sh[32487]: + [ -z slirp4netns ]
May 07 22:39:11 suda-ws01 dockerd-rootless.sh[32487]: + [ -z 65520 ]
May 07 22:39:11 suda-ws01 dockerd-rootless.sh[32487]: + [ -z ]
May 07 22:39:11 suda-ws01 dockerd-rootless.sh[32487]: + _DOCKERD_ROOTLESS_CHILD=1
May 07 22:39:11 suda-ws01 dockerd-rootless.sh[32487]: + export _DOCKERD_ROOTLESS_CHILD
May 07 22:39:11 suda-ws01 dockerd-rootless.sh[32487]: + exec rootlesskit --net=slirp4netns --mtu=65520 --slirp4netns-sandbox=auto --slirp4netns-seccomp=auto --disable-host-loopback --port-driver=builtin --copy-up=/etc --copy-up=/run --propagation=rslave /usr/local/bin/dockerd-rootless.sh
INFO[0001] + /usr/local/bin/docker version              
Client:
 Version:           20.03.0-dev
 API version:       1.41
 Go version:        go1.13.10
 Git commit:        904e4f4db
 Built:             Wed Apr 29 21:21:44 2020
 OS/Arch:           linux/amd64
 Experimental:      true

Server:
 Engine:
  Version:          dev
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.13.10
  Git commit:       c3b3aedfa4
  Built:            Wed Apr 29 21:21:03 2020
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          v1.3.0-520-g3f95bc5f
  GitCommit:        3f95bc5f18a7d9dceb1e7502d2fc6120900c5bfb
 runc:
  Version:          1.0.0-rc10+dev
  GitCommit:        d3ac6ba75a5dfcd5c4c00d7b8863fb1ea098be5d
 docker-init:
  Version:          0.18.0
  GitCommit:        fec3683
INFO[0001] To control docker service run: systemctl --user (start|stop|restart) docker.service 
INFO[0001] Make sure the following environment variables are set (or add them to ~/.bashrc):
export PATH=/usr/local/bin:$PATH
export DOCKER_HOST=unix:///run/user/1001/docker.sock

- Description for the changelog

add dockerd-rootless-setuptool

- A picture of a cute animal (not mandatory but encouraged)

🐧

@AkihiroSuda AkihiroSuda added the area/rootless Rootless Mode label May 7, 2020
@AkihiroSuda AkihiroSuda added this to the 20.03.0 milestone May 7, 2020
@AkihiroSuda
AkihiroSuda requested a review from tianon as a code owner May 7, 2020 13:40
@AkihiroSuda

AkihiroSuda commented May 7, 2020

Copy link
Copy Markdown
Member Author

@tonistiigi @tiborvass @tianon @thaJeztah @cpuguy83 PTAL
Sorry to bring this huge one right before the v20.0X freeze.

This was referenced May 7, 2020
Closed
Closed
@AkihiroSuda
AkihiroSuda force-pushed the dockerd-rootless-setuptool branch 2 times, most recently from 75729fe to a5aafa1 Compare May 7, 2020 14:34
tonistiigi
tonistiigi reviewed May 7, 2020
View reviewed changes
Comment thread Dockerfile Outdated
@AkihiroSuda
AkihiroSuda force-pushed the dockerd-rootless-setuptool branch 3 times, most recently from c2f144f to b85de3b Compare May 8, 2020 00:21
@tianon

tianon commented May 8, 2020 •
edited
Loading

Copy link
Copy Markdown
Member

I feel like I'm missing something obvious here, sorry. 😕

Which part of the shell script solution is complicated enough that a port to Go is simpler? I'm not at all a fan of curl ... | bash for installation, but at least with a shell script it's easy to crack it open and read what it's going to do before running it. If it's a compiled binary, it becomes a larger trust exercise more akin to Windows installers. 😕

Edit: I've read through both of #40707 and #40761, but reading through this code it still feels like a really long shell script written in Go, so I'm still really confused. 😞

@AkihiroSuda

AkihiroSuda commented May 8, 2020 •
edited
Loading

Copy link
Copy Markdown
Member Author

Motivations to use Go are:

  • Source files are splittable
  • Variable scopes are clear
  • Easier to handle errors
  • Easier to add unit tests
  • Less likely to hit busybox vs GNU incompatibility
  • Easier to parse CLI args

Alternatively I could use Python, but didn't want to introduce Python dependency.

@AkihiroSuda
AkihiroSuda force-pushed the dockerd-rootless-setuptool branch from b85de3b to 55fd18b Compare May 8, 2020 01:32
@AkihiroSuda
add dockerd-rootless-setuptool
6a4bdad 
The tool is expected to be used by https://get.docker.com/rootless script.
Can be included in RPM/DPKG packages as well.

Example usage: `dockerd-rootless-setuptool setup`

Signed-off-by: Akihiro Suda <[email protected]>
@AkihiroSuda
AkihiroSuda force-pushed the dockerd-rootless-setuptool branch from 55fd18b to 6a4bdad Compare May 8, 2020 04:03
@cpuguy83

cpuguy83 commented May 8, 2020

Copy link
Copy Markdown
Member

I tend to agree with @tianon here. I feel like this sacrifices too much on the trust/audit-ability front.

@AkihiroSuda AkihiroSuda mentioned this pull request May 11, 2020
Merged
@AkihiroSuda

AkihiroSuda commented May 11, 2020

Copy link
Copy Markdown
Member Author

rewrote in shell: #40950

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tonistiigi tonistiigi tonistiigi left review comments
@tianon tianon Awaiting requested review from tianon

Assignees

No one assigned

Labels

area/rootless Rootless Mode

Projects

None yet

Milestone

20.10.0

Development

Successfully merging this pull request may close these issues.

Move docker-install/rootless-install.sh (except the curl part) to this repo + rewrite in Go

4 participants

@AkihiroSuda @tianon @cpuguy83 @tonistiigi