3 commits

Author	SHA1	Message	Date
Akihiro Suda	3518383ed9	dockerd: fix rootless detection (alternative to #39024) ... The `--rootless` flag had a couple of issues: * #38702: euid=0, $USER="root" but no access to cgroup ("rootful" Docker in rootless Docker) * #39009: euid=0 but $USER="docker" (rootful boot2docker) To fix #38702, XDG dirs are ignored as in rootful Docker, unless the dockerd is directly running under RootlessKit namespaces. RootlessKit detection is implemented by checking whether `$ROOTLESSKIT_STATE_DIR` is set. To fix #39009, the non-robust `$USER` check is now completely removed. The entire logic can be illustrated as follows: ``` withRootlessKit := getenv("ROOTLESSKIT_STATE_DIR") rootlessMode := withRootlessKit || cliFlag("--rootless") honorXDG := withRootlessKit useRootlessKitDockerProxy := withRootlessKit removeCgroupSpec := rootlessMode adjustOOMScoreAdj := rootlessMode ``` Close #39024 Fix #38702 #39009 Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>	2019-04-25 16:47:01 +09:00
Sebastiaan van Stijn	c725eff3e2	Add more import comments ... Signed-off-by: Sebastiaan van Stijn <github@gone.nl>	2019-04-10 16:59:33 +02:00
Akihiro Suda	ec87479b7e	allow running dockerd in an unprivileged user namespace (rootless mode) ... Please refer to `docs/rootless.md`. TLDR: * Make sure `/etc/subuid` and `/etc/subgid` contain the entry for you * `dockerd-rootless.sh --experimental` * `docker -H unix://$XDG_RUNTIME_DIR/docker.sock run ...` Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>	2019-02-04 00:24:27 +09:00