Rootless Docker on Centos7

Running Docker containers and daemon rootless on a Centos7 VM via Vagrant.

Requirements

Vagrant

• Download vagrant and follow the installer's instructions.

• Install the Virtualbox Guest Additions via the following command:

  vagrant plugin install vagrant-vbguest

  Note: you will receive the mount errors described in Vagrant No VirtualBox Guest Additions installation found.

• Enable autocompletion:

  vagrant autocomplete install --bash

Build and Run

Bring up CentOS7 virtual machine and a rootless Docker process as docky:

vagrant up

SSH into the VM and switch to the docky user:

vagrant ssh

[vagrant@centos7 ~]# sudo su - docky

Verify Docker is running correctly using the hello-world image:

-bash-4.2$ docker run hello-world

Try out a web server like nginx:

-bash-4.2$ docker run -p 80:80 -d nginx:1.18-alpine

This should fail as a non-root docker may not expose a container on a privileged port (<1024). Try a different web application like the Ghost blog:

-bash-4.2$ docker run -p 2368:2368 -d ghost

On your local machine open a web browser and navigate to http://localhost:2368 (made possible by an existing Vagrant forwarded_port).

Teardown

Tearing down the VM is done with a single command:

vagrant destroy -f

See Vagrant: Destroy for additional information.

Resources

• Run the Docker daemon as a non-root user (Rootless mode)
• Isolate containers with a user namespace
• Setting up Docker with user namespaces on CentOS 7.4
• Experimenting with Rootless Docker
• Container Security: A Look at Rootless Containers
• Docker Running In Rootless Mode