kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity

dockerd: fix rootless detection (alternative to #39024)

Browse source 
The `--rootless` flag had a couple of issues:
* #38702: euid=0, $USER="root" but no access to cgroup ("rootful" Docker in rootless Docker)
* #39009: euid=0 but $USER="docker" (rootful boot2docker)

To fix #38702, XDG dirs are ignored as in rootful Docker, unless the
dockerd is directly running under RootlessKit namespaces.

RootlessKit detection is implemented by checking whether `$ROOTLESSKIT_STATE_DIR` is set.

To fix #39009, the non-robust `$USER` check is now completely removed.

The entire logic can be illustrated as follows:

```
withRootlessKit := getenv("ROOTLESSKIT_STATE_DIR")
rootlessMode := withRootlessKit || cliFlag("--rootless")
honorXDG := withRootlessKit
useRootlessKitDockerProxy := withRootlessKit
removeCgroupSpec := rootlessMode
adjustOOMScoreAdj := rootlessMode
```

Close #39024
Fix #38702 #39009

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
This commit is contained in:
Akihiro Suda 2019-04-19 16:53:58 +09:00
parent 3cd54c28fd
commit 3518383ed9
8 changed files with 61 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

7
cmd/dockerd/config_common_unix.go
View file

@ -9,12 +9,11 @@ import (
"github.com/docker/docker/daemon/config"
"github.com/docker/docker/opts"
"github.com/docker/docker/pkg/homedir"
"github.com/docker/docker/rootless"
"github.com/spf13/pflag"
)
func getDefaultPidFile() (string, error) {
if !rootless.RunningWithNonRootUsername() {
if !honorXDG {
return "/var/run/docker.pid", nil
}
runtimeDir, err := homedir.GetRuntimeDir()
@ -25,7 +24,7 @@ func getDefaultPidFile() (string, error) {
}
func getDefaultDataRoot() (string, error) {
if !rootless.RunningWithNonRootUsername() {
if !honorXDG {
return "/var/lib/docker", nil
}
dataHome, err := homedir.GetDataHome()
@ -36,7 +35,7 @@ func getDefaultDataRoot() (string, error) {
}
func getDefaultExecRoot() (string, error) {
if !rootless.RunningWithNonRootUsername() {
if !honorXDG {
return "/var/run/docker", nil
}
runtimeDir, err := homedir.GetRuntimeDir()