Docker kasutamine operatsioonisüsteemiga Ubuntu - rootless

Sissejuhatus

TODO

Ettevalmistamine

Paigaldada docker-ce tavalisel viisil ning lülitada nö süsteemne käivitamine välja, parem teha ka reboot

# systemctl disable --now docker.service docker.socket
# reboot

Kasutajaks on sobiv minna käsuga

# machinectl shell imre@

imre@ubu2020:~$ dockerd-rootless-setuptool.sh install
[INFO] Creating /home/imre/.config/systemd/user/docker.service
[INFO] starting systemd service docker.service
+ systemctl --user start docker.service
+ sleep 3
+ systemctl --user --no-pager --full status docker.service
● docker.service - Docker Application Container Engine (Rootless)
     Loaded: loaded (/home/imre/.config/systemd/user/docker.service; disabled; vendor preset: enabled)
     Active: active (running) since Sun 2021-08-08 17:02:05 UTC; 3s ago
       Docs: https://docs.docker.com/go/rootless/
   Main PID: 10710 (rootlesskit)
     CGroup: /user.slice/user-1001.slice/user@1001.service/docker.service
             ├─10710 rootlesskit --net=slirp4netns --mtu=65520 --slirp4netns-sandbox=auto --slirp4netns-seccomp=auto --disable-host-loopback --port-driver=builtin --copy-up=/etc --copy-up=/run --propagation=rslave /usr/bin/dockerd-rootless.sh
             ├─10722 /proc/self/exe --net=slirp4netns --mtu=65520 --slirp4netns-sandbox=auto --slirp4netns-seccomp=auto --disable-host-loopback --port-driver=builtin --copy-up=/etc --copy-up=/run --propagation=rslave /usr/bin/dockerd-rootless.sh
             ├─10743 slirp4netns --mtu 65520 -r 3 --disable-host-loopback --enable-sandbox --enable-seccomp 10722 tap0
             ├─10750 dockerd
             └─10769 containerd --config /run/user/1001/docker/containerd/containerd.toml --log-level info

...

+ DOCKER_HOST=unix:///run/user/1001/docker.sock /usr/bin/docker version
Client: Docker Engine - Community
 Version:           20.10.8
 API version:       1.41
 Go version:        go1.16.6
 Git commit:        3967b7d
 Built:             Fri Jul 30 19:54:08 2021
 OS/Arch:           linux/amd64
 Context:           default
 Experimental:      true

Server: Docker Engine - Community
 Engine:
  Version:          20.10.8
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.16.6
  Git commit:       75249d8
  Built:            Fri Jul 30 19:52:16 2021
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.4.9
  GitCommit:        e25210fe30a0a703442421b0f60afac609f950a3
 runc:
  Version:          1.0.1
  GitCommit:        v1.0.1-0-g4144b63
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0
+ systemctl --user enable docker.service
Created symlink /home/imre/.config/systemd/user/default.target.wants/docker.service → /home/imre/.config/systemd/user/docker.service.
[INFO] Installed docker.service successfully.
[INFO] To control docker.service, run: `systemctl --user (start|stop|restart) docker.service`
[INFO] To run docker.service on system startup, run: `sudo loginctl enable-linger imre`

[INFO] Creating CLI context "rootless"
Successfully created context "rootless"

[INFO] Make sure the following environment variables are set (or add them to ~/.bashrc):

export PATH=/usr/bin:$PATH
export DOCKER_HOST=unix:///run/user/1001/docker.sock

Selleks, et kasutaja dockerindus ärkaks peale rebooti automaatselt sobib öelda

# loginctl enable-linger imre

Tulemusena moodustatakse oluline fail

root@ubu2020:~# ls -ld /var/lib/systemd/linger/*
-rw-r--r-- 1 root root 0 Jun 28  2020 /var/lib/systemd/linger/imre

Kasutaja lingering olekut näeb käsu väljundist (sobib pigem anda kasutajana)

# loginctl user-status imre

Kasutamine

TODO

Kasulikud lisamaterjalid

• https://docs.docker.com/engine/security/rootless/