I reinstalled Docker and finally got rootless mode working. My goal is to run a playit tunnel in one container and a Minecraft server in another, using rootless Docker. This setup works normally when Docker runs in rootful mode, but repeating the same configuration under rootless mode fails when starting the container with: "failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: can't get final child's PID from pipe: EOF". I've been troubleshooting this for several days and would appreciate ideas on what rootless-specific setting, permission, or container requirement might be causing the failure.
2 Answers
User namespace remapping is another option. Docker still runs with a root-owned daemon, but root inside the container is mapped to an unprivileged host UID. It’s a middle ground, although bind-mount permissions can become awkward because files may appear owned by a remapped UID such as 100000. You have to configure the subordinate UID/GID ranges and make sure mounted directories are owned or accessible by the mapped range.
Rootless Docker reduces the risk from the Docker daemon and from a process escaping a container with root privileges. It can also expose compatibility issues with containers that expect root-level capabilities, privileged networking, device access, or unrestricted bind mounts. Since this works in rootful mode, compare the container’s required capabilities, mounted paths, and networking options first; one of those may not be available to an unprivileged user.
Running rootful Docker with every capability dropped and no-new-privileges enabled can improve containment, but it isn’t exactly equivalent to rootless mode because the daemon itself still has root privileges. Rootless generally gives stronger protection against a daemon compromise, while user namespace remapping can be easier for workloads that need more traditional Docker behavior.