Unable to run Docker Daemon in the dind-rootless image

[wwpete]

I think there's an issue with the dind-rootless image.

Pulling and running the container:
docker run -it docker:dind-rootless /bin/sh

Then running dockerd returns:

INFO[2020-07-17T20:50:32.355617100Z] Starting up dockerd needs to be started with root. To see how to run dockerd in rootless mode with unprivileged user, see the documentation

According to the documentation here (which I assume is the documentation in question):
dockerd-rootless.sh --experimental

returns:
/bin/sh: dockerd-rootless.sh: not found

I'm not able to find a single example online that can show me how to start Docker daemon in a Docker container while being rootless (no --privileged flag)

[yosifkit]

--privileged is still required due to seccomp, apparmor, procfs, and sysfs stuff

- #165

Rather than an extra dependency on dockerd-rootless.sh, the functionality was just added to the dockerd-entrypoint.sh. See the changes added in #174 and related issues for more information.

This #174 (comment) has a good example.

[wwpete]

"--privileged is still required due to seccomp, apparmor, procfs, and sysfs stuff"

Hmm, I see. Thanks for the inputs, I managed to run the container successfully locally. However is this ever going to change in the future?

The --privileged flag puts a lot of limitations on deployments on platforms such as AWS Fargate (which does not allow privileged access at the container level)

[tianon]

That's a great question, but one we can't answer here -- we simply package Docker as-is, along with the scripts/tools necessary to enable whatever rootless support it natively has. I would hope it's an upstream goal to reduce the set of permissions necessary for running rootless in a container, but to be fair, it's not exactly the target use case of rootless (running on infrastructure where you don't have root or Docker access at all is).

For further help/discussion, I'd suggest trying the Docker Community Forums, the Docker Community Slack, or Stack Overflow.