Skip to content

Update RootlessKit (3.0.0)#52319

Merged
AkihiroSuda merged 1 commit intomoby:masterfrom
AkihiroSuda:rootlesskit-v3
Apr 25, 2026
Merged

Update RootlessKit (3.0.0)#52319
AkihiroSuda merged 1 commit intomoby:masterfrom
AkihiroSuda:rootlesskit-v3

Conversation

@AkihiroSuda
Copy link
Copy Markdown
Member

@AkihiroSuda AkihiroSuda commented Apr 7, 2026 •
edited
Loading

- What I did

Updated RootlessKit to v3.0. https://github.com/rootless-containers/rootlesskit/releases/tag/v3.0.0

  • slirp4netns/vpnkit/pasta is no longer needed as gvisor-tap-vsock is now embedded in RootlessKit.
    slirp4netns/vpnkit/pasta is still used when installed.
  • The builtin port driver can now correctly propagate the source IP, when
    userland-proxy is disabled.

- How I did it

- How to verify it

dockerd-rootless-setuptool.sh install
docker run -d -p 8080:80 nginx:alpine
  • It should no longer requires one of slirp4netns, vpnkit, or pasta to be installed
  • The src IP should be propagated properly, when userland-proxy is disabled:
sudo modprobe br_netfilter
echo '{"userland-proxy":false}' >~/.config/docker/daemon.json
systemctl --user restart docker

- Human readable description for the release notes

Update RootlessKit (3.0.0)

- A picture of a cute animal (not mandatory but encouraged)

Relevant:

@AkihiroSuda AkihiroSuda mentioned this pull request Apr 7, 2026
Closed
@AkihiroSuda AkihiroSuda added kind/enhancement Enhancements are not bugs or new features but can improve usability or performance. area/networking/portmapping Networking labels Apr 7, 2026
@AkihiroSuda AkihiroSuda added this to the 29.5.0 milestone Apr 7, 2026
@AkihiroSuda AkihiroSuda mentioned this pull request Apr 7, 2026
Open
3 tasks
@AkihiroSuda AkihiroSuda mentioned this pull request Apr 7, 2026
Merged
1 task
@thaJeztah thaJeztah mentioned this pull request Apr 7, 2026
Closed
1 task
@AkihiroSuda AkihiroSuda force-pushed the rootlesskit-v3 branch 2 times, most recently from 7c90798 to acbb8e1 Compare April 9, 2026 19:03
@AkihiroSuda AkihiroSuda marked this pull request as ready for review April 9, 2026 19:04
@AkihiroSuda AkihiroSuda requested a review from tianon as a code owner April 9, 2026 19:04
@AkihiroSuda AkihiroSuda mentioned this pull request Apr 13, 2026
Merged
@AkihiroSuda
Copy link
Copy Markdown
Member Author

AkihiroSuda commented Apr 14, 2026

@tonistiigi @crazy-max Can we merge this, or is the master branch not thawed yet for v29.5?

@crazy-max crazy-max requested review from thaJeztah and vvoland April 14, 2026 09:58
@crazy-max
Copy link
Copy Markdown
Member

crazy-max commented Apr 14, 2026

@AkihiroSuda Yes LGTM

PTAL @thaJeztah @vvoland

@thaJeztah
Copy link
Copy Markdown
Member

thaJeztah commented Apr 17, 2026

@AkihiroSuda is the vendor code compatible with v2? If so, we can already bring in the vendor changes, then do the binary update for v29.5

@thaJeztah thaJeztah mentioned this pull request Apr 17, 2026
Closed
1 task
@AkihiroSuda
Copy link
Copy Markdown
Member Author

AkihiroSuda commented Apr 17, 2026

is the vendor code compatible with v2?

Expected to be compatible with v2, but basically it should be used in conjunction with the v3 binary

@AkihiroSuda
Copy link
Copy Markdown
Member Author

AkihiroSuda commented Apr 22, 2026

Rebased

@AkihiroSuda
Copy link
Copy Markdown
Member Author

AkihiroSuda commented Apr 24, 2026

Rerebased

@thaJeztah
Copy link
Copy Markdown
Member

thaJeztah commented Apr 25, 2026 •
edited
Loading

I think this should be ready to go now 😅 #50221 (comment)

Screenshot 2026-04-25 at 15 19 03

One last check before we merge;

is the vendor code compatible with v2?

Expected to be compatible with v2, but basically it should be used in conjunction with the v3 binary

Should we have a separate PR for the binary update to verify that updating the vendor without updating the binary works, and vice-versa?

We must likely account for;

  • existing docker installs to update rootlesskit to v3 (so v2 client and v3 rootlesskit)
  • docker v29.5 daemons running with an outdated (v2) rootlesskit

For the last one, we can update our packaging to require version X, but that's not done yet; https://github.com/docker/packaging/blob/cbccfd8169ad821b1e085d8324cc7ce252afc998/pkg/docker-engine/deb/control#L30

@AkihiroSuda AkihiroSuda mentioned this pull request Apr 25, 2026
Merged
@AkihiroSuda
Update RootlessKit (3.0.0)
5249b1d 
- slirp4netns/vpnkit is no longer needed as gvisor-tap-vsock is now embedded in RootlessKit.
  slirp4netns/vpnkit is still used when installed.
- The `builtin` port driver can now correctly propagate the source IP, when
  `userland-proxy` is disabled.

Signed-off-by: Akihiro Suda <[email protected]>
@AkihiroSuda
Copy link
Copy Markdown
Member Author

AkihiroSuda commented Apr 25, 2026

This PR now only updates the binary.

The go library is being updated in:

@thaJeztah
Copy link
Copy Markdown
Member

thaJeztah commented Apr 25, 2026

Thanks! Let's have CI have its run (we need to re-kick some probably GitHub flakiness), then ready to go from my perspective.

thaJeztah
thaJeztah approved these changes Apr 25, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@thaJeztah thaJeztah left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM if CI is happy

@AkihiroSuda AkihiroSuda merged commit 1933581 into moby:master Apr 25, 2026
321 of 324 checks passed
@AkihiroSuda
Copy link
Copy Markdown
Member Author

AkihiroSuda commented Apr 25, 2026

Docs PR

This was referenced Apr 25, 2026
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tonistiigi tonistiigi tonistiigi approved these changes

@thaJeztah thaJeztah thaJeztah approved these changes

@crazy-max crazy-max crazy-max approved these changes

@tianon tianon Awaiting requested review from tianon tianon is a code owner

@vvoland vvoland Awaiting requested review from vvoland

Assignees

No one assigned

Labels

area/contrib area/daemon Core Engine area/dependencies area/docs area/networking/portmapping Networking area/packaging area/rootless Rootless Mode impact/changelog kind/enhancement Enhancements are not bugs or new features but can improve usability or performance.

Projects

None yet

Milestone

29.5.0

Development

Successfully merging this pull request may close these issues.

4 participants

@AkihiroSuda @crazy-max @thaJeztah @tonistiigi