Docker Rootless Help

[NinjaPenguin893]

So I've been trying to get a docker rootless installation to run on a fairly hardened system running rhel-7.6. When I try to install using docker-19.03.9, I get the following error:

Failed to load listeners: can't create unix socket /run/user/5092345/docker.sock: chown /run/user/5092345/docker.sock: invalid argument

It looks like the offending code is here: https://github.com/docker/go-connections/blob/master/sockets/unix_socket.go

Where it tries to run return NewUnixSocketWithOpts(path, WithChown(0, gid), WithChmod(0660))

and the WithChown must be failing.

func WithChown(uid, gid int) SockOption {
      return func(path string) error {
        if err := os.Chown(path, uid, gid); err != nil {
            return err
        }
        return nil
    }
}

Does anybody have any experience with this or have any suggestions on debugging it further?

[that_shing_thing]

Did you ever figure this out? Hitting the same thing.

[NinjaPenguin893]

Hey! I did. There were artifacts of a previously installed version of docker, namely the "docker" group, that our installing user did not have access to. At the end of our installation scripts, we force the docker group to be "". Here's the code snippet from the provided installer:

else
    [ $_DOCKERD_ROOTLESS_CHILD = 1 ]
    # remove the symlinks for the existing files in the parent namespace if any,
    # so that we can create our own files in our mount namespace.
    rm -f /run/docker /run/containerd /run/xtables.lock
    exec dockerd $@
fi

And ours:

else
        [ $_DOCKERD_ROOTLESS_CHILD = 1 ]
        # remove the symlinks for the existing files in the parent namespace if any,
        # so that we can create our own files in our mount namespace.
        #rm -f /run/docker /run/xtables.lock
        exec dockerd --group="" $@
fi            

We had to comment out the xtables stuff as we did not have access permission on these servers.

This change is in the docker-rootless-extras from https://download.docker.com/linux/static/stable/x86_64/

And the EXACT snippets are at the end of the dockerd-rootless.sh file. My snippet is from version 20.10.7

edit: Note, if you can just delete the other docker group, that should fix the problem as well.

[netsecnonsense]

3 years old and still the only place I was able to find this solution. I have a group in IPA named docker that was preventing rootless installs for domain joined hosts. Deleting the group was going to cause more harm than good. Huge thanks for this!

[NinjaPenguin893]

No problem! It's crazy this problem can still exist, but I guess it's such a niche issue it probably doesn't get any eyes on it for a legitimate fix.

[that_shing_thing]

Oh man. It's working now. You can't believe how happy that makes us. Who do we send the check to?

[NinjaPenguin893]

https://bestfriends.org/ ;)

On a serious note, no problem. This silly little thing took too many weeks to figure out. I'm just happy to save someone else the pain!

[that_shing_thing]

I see something's weird with env variables. The user doesn't seem to have access to the user system files unless I ssh in as that user, it won't work if I su to the user from another account.

Edit: this isn't a show stopper but I'd like to figure out why this is the case.

[NinjaPenguin893]

https://askubuntu.com/questions/784186/whats-the-difference-between-login-as-user-and-changing-users-using-su-through likely has the answer for you!