Hacker News Reader

Comment by djsumdog | Hacker News Reader

I wish it were possible to run Docker as a regular user, or run a separate Docker in Docker in CI (I assume the Docker CI runners on things like Gitlab are running as root or shared via `-v /var/run/docker.sock:/var/run/docker.sock` since Docker-in-Docker is only recommended for actually developing Docker)

View on HN

Docker is a front end to underlying technologies which do the work.

Red Hat created a Kubernetes compatible set of tools for running Docker compatible OCI containers called CRI-O https://cri-o.io/ with RHEL/Centos 7.7 and 8+ you can run containers as a regular user: https://www.redhat.com/en/blog/preview-running-containers-wi... using their tools.

And Fedora!

Good news, there is a lot of work on that front, including an official "rootless" distribution: https://get.docker.com/rootless

The main thing about it is cgroups are disabled and it requires userspace networking.

Here's a write-up on it: https://engineering.docker.com/2019/02/experimenting-with-ro...

As well, you may need to use a fuse based implementation of overlayfs

It is possible to run Docker in Docker in CI. At a previous job I built containers that ran docker as Bamboo build agents. The containers did not use the docker socket and instead had their own and their own `/var/lib/docker` directory. However, the containers have to run docker as root (I started docker and then dropped privileges to run the bamboo agent) and have to run with the `--privileged` option. The advantage of doing it that way was that the hosts image storage was cleaned up with the containers and separate from the host. Disadvantage was that you have to use loopback based storage which makes docker a little slower. I don't think there's a huge difference in security since docker would end up being accessible via the socket anyway and by dropping privileges for the build agent you're losing the capabilities that you get from `--privileged`.

The issue is that if you want to communicate with the outside world you need to create a network bridge, which only a sufficiently privileged user on the host system can do.

An unprivileged-user docker daemon would be limited to either communicate with an isolated network namespace on the parent side or do userspace forwarding of network traffic. Or it would require a privileged helper for the network parts.

Reply on news.ycombinator.com