From 3518383ed990202d93e5458782d2c975c48ececd Mon Sep 17 00:00:00 2001 From: Akihiro Suda Date: Fri, 19 Apr 2019 16:53:58 +0900 Subject: [PATCH] dockerd: fix rootless detection (alternative to #39024) The `--rootless` flag had a couple of issues: * #38702: euid=0, $USER="root" but no access to cgroup ("rootful" Docker in rootless Docker) * #39009: euid=0 but $USER="docker" (rootful boot2docker) To fix #38702, XDG dirs are ignored as in rootful Docker, unless the dockerd is directly running under RootlessKit namespaces. RootlessKit detection is implemented by checking whether `$ROOTLESSKIT_STATE_DIR` is set. To fix #39009, the non-robust `$USER` check is now completely removed. The entire logic can be illustrated as follows: ``` withRootlessKit := getenv("ROOTLESSKIT_STATE_DIR") rootlessMode := withRootlessKit || cliFlag("--rootless") honorXDG := withRootlessKit useRootlessKitDockerProxy := withRootlessKit removeCgroupSpec := rootlessMode adjustOOMScoreAdj := rootlessMode ``` Close #39024 Fix #38702 #39009 Signed-off-by: Akihiro Suda --- cmd/dockerd/config_common_unix.go | 7 +++---- cmd/dockerd/config_unix.go | 19 ++++++++++++++++--- cmd/dockerd/daemon.go | 12 +++++++++--- cmd/dockerd/daemon_unix.go | 5 ++--- cmd/dockerd/docker.go | 13 +++++++++++++ docs/rootless.md | 3 +-- opts/hosts.go | 6 +++--- rootless/rootless.go | 29 ++++++++++++++--------------- 8 files changed, 61 insertions(+), 33 deletions(-) diff --git a/cmd/dockerd/config_common_unix.go b/cmd/dockerd/config_common_unix.go index c6526285f3..021b2b28a2 100644 --- a/cmd/dockerd/config_common_unix.go +++ b/cmd/dockerd/config_common_unix.go @@ -9,12 +9,11 @@ import ( "github.com/docker/docker/daemon/config" "github.com/docker/docker/opts" "github.com/docker/docker/pkg/homedir" - "github.com/docker/docker/rootless" "github.com/spf13/pflag" ) func getDefaultPidFile() (string, error) { - if !rootless.RunningWithNonRootUsername() { + if !honorXDG { return "/var/run/docker.pid", nil } runtimeDir, err := homedir.GetRuntimeDir() @@ -25,7 +24,7 @@ func getDefaultPidFile() (string, error) { } func getDefaultDataRoot() (string, error) { - if !rootless.RunningWithNonRootUsername() { + if !honorXDG { return "/var/lib/docker", nil } dataHome, err := homedir.GetDataHome() @@ -36,7 +35,7 @@ func getDefaultDataRoot() (string, error) { } func getDefaultExecRoot() (string, error) { - if !rootless.RunningWithNonRootUsername() { + if !honorXDG { return "/var/run/docker", nil } runtimeDir, err := homedir.GetRuntimeDir() diff --git a/cmd/dockerd/config_unix.go b/cmd/dockerd/config_unix.go index cc42ff36c8..d2a8cd22a7 100644 --- a/cmd/dockerd/config_unix.go +++ b/cmd/dockerd/config_unix.go @@ -3,10 +3,13 @@ package main import ( + "os/exec" + "github.com/docker/docker/daemon/config" "github.com/docker/docker/opts" "github.com/docker/docker/rootless" "github.com/docker/go-units" + "github.com/pkg/errors" "github.com/spf13/pflag" ) @@ -35,7 +38,16 @@ func installConfigFlags(conf *config.Config, flags *pflag.FlagSet) error { flags.BoolVar(&conf.BridgeConfig.EnableIPv6, "ipv6", false, "Enable IPv6 networking") flags.StringVar(&conf.BridgeConfig.FixedCIDRv6, "fixed-cidr-v6", "", "IPv6 subnet for fixed IPs") flags.BoolVar(&conf.BridgeConfig.EnableUserlandProxy, "userland-proxy", true, "Use userland proxy for loopback traffic") - flags.StringVar(&conf.BridgeConfig.UserlandProxyPath, "userland-proxy-path", "", "Path to the userland proxy binary") + defaultUserlandProxyPath := "" + if rootless.RunningWithRootlessKit() { + var err error + // use rootlesskit-docker-proxy for exposing the ports in RootlessKit netns to the initial namespace. + defaultUserlandProxyPath, err = exec.LookPath(rootless.RootlessKitDockerProxyBinary) + if err != nil { + return errors.Wrapf(err, "running with RootlessKit, but %s not installed", rootless.RootlessKitDockerProxyBinary) + } + } + flags.StringVar(&conf.BridgeConfig.UserlandProxyPath, "userland-proxy-path", defaultUserlandProxyPath, "Path to the userland proxy binary") flags.StringVar(&conf.CgroupParent, "cgroup-parent", "", "Set parent cgroup for all containers") flags.StringVar(&conf.RemappedRoot, "userns-remap", "", "User/Group setting for user namespaces") flags.BoolVar(&conf.LiveRestoreEnabled, "live-restore", false, "Enable live restore of docker when containers are still running") @@ -49,7 +61,8 @@ func installConfigFlags(conf *config.Config, flags *pflag.FlagSet) error { flags.BoolVar(&conf.NoNewPrivileges, "no-new-privileges", false, "Set no-new-privileges by default for new containers") flags.StringVar(&conf.IpcMode, "default-ipc-mode", config.DefaultIpcMode, `Default mode for containers ipc ("shareable" | "private")`) flags.Var(&conf.NetworkConfig.DefaultAddressPools, "default-address-pool", "Default address pools for node specific local networks") - // Mostly users don't need to set this flag explicitly. - flags.BoolVar(&conf.Rootless, "rootless", rootless.RunningWithNonRootUsername(), "Enable rootless mode (experimental)") + // rootless needs to be explicitly specified for running "rootful" dockerd in rootless dockerd (#38702) + // Note that defaultUserlandProxyPath and honorXDG are configured according to the value of rootless.RunningWithRootlessKit, not the value of --rootless. + flags.BoolVar(&conf.Rootless, "rootless", rootless.RunningWithRootlessKit(), "Enable rootless mode; typically used with RootlessKit (experimental)") return nil } diff --git a/cmd/dockerd/daemon.go b/cmd/dockerd/daemon.go index b1fad91deb..fcb7b0b5b2 100644 --- a/cmd/dockerd/daemon.go +++ b/cmd/dockerd/daemon.go @@ -103,6 +103,12 @@ func (cli *DaemonCli) start(opts *daemonOptions) (err error) { if cli.Config.IsRootless() { logrus.Warn("Running in rootless mode. Cgroups, AppArmor, and CRIU are disabled.") } + if rootless.RunningWithRootlessKit() { + logrus.Info("Running with RootlessKit integration") + if !cli.Config.IsRootless() { + return fmt.Errorf("rootless mode needs to be enabled for running with RootlessKit") + } + } } else { if cli.Config.IsRootless() { return fmt.Errorf("rootless mode is supported only when running in experimental mode") @@ -591,7 +597,7 @@ func loadListeners(cli *DaemonCli, serverConfig *apiserver.Config) ([]string, er var hosts []string for i := 0; i < len(cli.Config.Hosts); i++ { var err error - if cli.Config.Hosts[i], err = dopts.ParseHost(cli.Config.TLS, rootless.RunningWithNonRootUsername(), cli.Config.Hosts[i]); err != nil { + if cli.Config.Hosts[i], err = dopts.ParseHost(cli.Config.TLS, honorXDG, cli.Config.Hosts[i]); err != nil { return nil, errors.Wrapf(err, "error parsing -H %s", cli.Config.Hosts[i]) } @@ -668,9 +674,9 @@ func validateAuthzPlugins(requestedPlugins []string, pg plugingetter.PluginGette return nil } -func systemContainerdRunning(isRootless bool) (string, bool, error) { +func systemContainerdRunning(honorXDG bool) (string, bool, error) { addr := containerddefaults.DefaultAddress - if isRootless { + if honorXDG { runtimeDir, err := homedir.GetRuntimeDir() if err != nil { return "", false, err diff --git a/cmd/dockerd/daemon_unix.go b/cmd/dockerd/daemon_unix.go index 2876c057ad..8f74026d2e 100644 --- a/cmd/dockerd/daemon_unix.go +++ b/cmd/dockerd/daemon_unix.go @@ -18,14 +18,13 @@ import ( "github.com/docker/docker/daemon/config" "github.com/docker/docker/libcontainerd/supervisor" "github.com/docker/docker/pkg/homedir" - "github.com/docker/docker/rootless" "github.com/docker/libnetwork/portallocator" "github.com/pkg/errors" "golang.org/x/sys/unix" ) func getDefaultDaemonConfigDir() (string, error) { - if !rootless.RunningWithNonRootUsername() { + if !honorXDG { return "/etc/docker", nil } // NOTE: CLI uses ~/.docker while the daemon uses ~/.config/docker, because @@ -148,7 +147,7 @@ func newCgroupParent(config *config.Config) string { func (cli *DaemonCli) initContainerD(ctx context.Context) (func(time.Duration) error, error) { var waitForShutdown func(time.Duration) error if cli.Config.ContainerdAddr == "" { - systemContainerdAddr, ok, err := systemContainerdRunning(cli.Config.IsRootless()) + systemContainerdAddr, ok, err := systemContainerdRunning(honorXDG) if err != nil { return nil, errors.Wrap(err, "could not determine whether the system containerd is running") } diff --git a/cmd/dockerd/docker.go b/cmd/dockerd/docker.go index 4b4f5acdea..bace6be81a 100644 --- a/cmd/dockerd/docker.go +++ b/cmd/dockerd/docker.go @@ -10,11 +10,16 @@ import ( "github.com/docker/docker/pkg/jsonmessage" "github.com/docker/docker/pkg/reexec" "github.com/docker/docker/pkg/term" + "github.com/docker/docker/rootless" "github.com/moby/buildkit/util/apicaps" "github.com/sirupsen/logrus" "github.com/spf13/cobra" ) +var ( + honorXDG bool +) + func newDaemonCommand() (*cobra.Command, error) { opts := newDaemonOptions(config.New()) @@ -53,6 +58,14 @@ func init() { if dockerversion.ProductName != "" { apicaps.ExportedProduct = dockerversion.ProductName } + // When running with RootlessKit, $XDG_RUNTIME_DIR, $XDG_DATA_HOME, and $XDG_CONFIG_HOME needs to be + // honored as the default dirs, because we are unlikely to have permissions to access the system-wide + // directories. + // + // Note that even running with --rootless, when not running with RootlessKit, honorXDG needs to be kept false, + // because the system-wide directories in the current mount namespace are expected to be accessible. + // ("rootful" dockerd in rootless dockerd, #38702) + honorXDG = rootless.RunningWithRootlessKit() } func main() { diff --git a/docs/rootless.md b/docs/rootless.md index b84a4f3608..a2ed9b917c 100644 --- a/docs/rootless.md +++ b/docs/rootless.md @@ -55,10 +55,9 @@ penguin:231072:65536 You need to run `dockerd-rootless.sh` instead of `dockerd`. ```console -$ dockerd-rootless.sh --experimental --userland-proxy --userland-proxy-path=$(which rootlesskit-docker-proxy)" +$ dockerd-rootless.sh --experimental ``` As Rootless mode is experimental per se, currently you always need to run `dockerd-rootless.sh` with `--experimental`. -Also, to expose ports, you need to set `--userland-proxy-path` to the path of `rootlesskit-docker-proxy` binary. Remarks: * The socket path is set to `$XDG_RUNTIME_DIR/docker.sock` by default. `$XDG_RUNTIME_DIR` is typically set to `/run/user/$UID`. diff --git a/opts/hosts.go b/opts/hosts.go index 3d8785f11c..a6f2662df0 100644 --- a/opts/hosts.go +++ b/opts/hosts.go @@ -45,13 +45,13 @@ func ValidateHost(val string) (string, error) { } // ParseHost and set defaults for a Daemon host string. -// defaultToTLS is preferred over defaultToUnixRootless. -func ParseHost(defaultToTLS, defaultToUnixRootless bool, val string) (string, error) { +// defaultToTLS is preferred over defaultToUnixXDG. +func ParseHost(defaultToTLS, defaultToUnixXDG bool, val string) (string, error) { host := strings.TrimSpace(val) if host == "" { if defaultToTLS { host = DefaultTLSHost - } else if defaultToUnixRootless { + } else if defaultToUnixXDG { runtimeDir, err := homedir.GetRuntimeDir() if err != nil { return "", err diff --git a/rootless/rootless.go b/rootless/rootless.go index cb4f8979d4..376d5263de 100644 --- a/rootless/rootless.go +++ b/rootless/rootless.go @@ -5,22 +5,21 @@ import ( "sync" ) -var ( - runningWithNonRootUsername bool - runningWithNonRootUsernameOnce sync.Once +const ( + // RootlessKitDockerProxyBinary is the binary name of rootlesskit-docker-proxy + RootlessKitDockerProxyBinary = "rootlesskit-docker-proxy" ) -// RunningWithNonRootUsername returns true if we $USER is set to a non-root value, -// regardless to the UID/EUID value. -// -// The value of this variable is mostly used for configuring default paths. -// If the value is true, $HOME and $XDG_RUNTIME_DIR should be honored for setting up the default paths. -// If false (not only EUID==0 but also $USER==root), $HOME and $XDG_RUNTIME_DIR should be ignored -// even if we are in a user namespace. -func RunningWithNonRootUsername() bool { - runningWithNonRootUsernameOnce.Do(func() { - u := os.Getenv("USER") - runningWithNonRootUsername = u != "" && u != "root" +var ( + runningWithRootlessKit bool + runningWithRootlessKitOnce sync.Once +) + +// RunningWithRootlessKit returns true if running under RootlessKit namespaces. +func RunningWithRootlessKit() bool { + runningWithRootlessKitOnce.Do(func() { + u := os.Getenv("ROOTLESSKIT_STATE_DIR") + runningWithRootlessKit = u != "" }) - return runningWithNonRootUsername + return runningWithRootlessKit }