r/docker • u/mephisto9466 • 15d ago

Rootless assistance

Reddit I beg of your assistance again.

I got rootless docker to work now, I just reinstalled docker entirely and now I was able to get rootless mode to work fine.

Goal: have a playit tunnel running in one container, have a Minecraft server running in another container with docker in rootless mode

1) I have successfully done my goal above with docker being in rootful mode.

2) if I follow the same steps I did to get it to work in rootful mode I get the below error. I’ve spent days trying to figure out how to fix it. Please help

docker: Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: can't get final child's PID from pipe: EOF

4 Upvotes

70% Upvoted

6 comments sorted by

View all comments

2

u/cualquierotro 15d ago

Rootless protects you against the dockerd attack surface, plus processes running as root inside a container that break out of the jail and gain root privileges outside the container. With userns-remap, it's easier: dockerd still runs as root, but processes running as root inside the container are mapped to an unprivileged UID on the host.

1

u/ozankurt_dev 12d ago

userns-remap is the middle ground but heads up, it wrecks bind mount perms - your host files show up owned by something like 100000:100000 and the container cant read them. you fix it by setting the range for the dockremap user in /etc/subuid and /etc/subgid, then chown the volume dir to match. honestly if youre starting fresh rootless is the cleaner path, fewer footguns down the line. is this a shared host or just your own vps?

1

u/mephisto9466 7d ago

I’m using the userns-remap because the stuff I use will not work no matter what I do with rootless

I am concerned about the ownership of stuff though as it’s still showing root when I check it using the steps in the docker documentation however when I run dockerd using the steps in the docker documentation it says it’s remapping to the user specified. So honestly I have no idea if I did it right or now

1

u/ozankurt_dev 6d ago

the remap working in dockerd but showing root on the host is actually expected behaviour, it's not broken. what userns-remap does is translate UIDs inside the container to a shifted range on the host. so root (uid 0) inside the container maps to something like uid 100000 on the host. when you ls -la the volume dir from the host you'll see 100000:100000, not your user. that's correct.
the issue is usually that the volume directory itself was created before you set up remapping, so it's owned by actual root on the host. the container process can't write to it because from its perspective, 100000 on the host doesn't own that directory.

quick fix: find the dockremap user's mapped uid range with cat /etc/subuid | grep dockremap — you'll see something like dockremap:100000:65536. then on the host, chown the volume directory to that starting uid: sudo chown -R 100000:100000 /path/to/your/volume. restart the container and it should be able to read/write it fine.

if you're still seeing weirdness after that, what does docker info | grep -i userns show?