From 77de535364e099a75ba5a1fe5a7e1ca6b2a3dad3 Mon Sep 17 00:00:00 2001 From: Akihiro Suda Date: Wed, 6 Mar 2024 07:38:55 +0900 Subject: [PATCH 1/2] Dockerfile: update RootlessKit to v2.0.2 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit https://github.com/rootless-containers/rootlesskit/compare/v2.0.1...v2.0.2 Signed-off-by: Akihiro Suda (cherry picked from commit 49fd8df9b9319f2d5ceee40ef0b335fa8ba0705e) Signed-off-by: Paweł Gronowski --- Dockerfile | 2 +- hack/dockerfile/install/rootlesskit.installer | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index e5656f584aea4..948dc73096710 100644 --- a/Dockerfile +++ b/Dockerfile @@ -352,7 +352,7 @@ FROM base AS rootlesskit-src WORKDIR /usr/src/rootlesskit RUN git init . && git remote add origin "https://github.com/rootless-containers/rootlesskit.git" # When updating, also update vendor.mod and hack/dockerfile/install/rootlesskit.installer accordingly. -ARG ROOTLESSKIT_VERSION=v2.0.1 +ARG ROOTLESSKIT_VERSION=v2.0.2 RUN git fetch -q --depth 1 origin "${ROOTLESSKIT_VERSION}" +refs/tags/*:refs/tags/* && git checkout -q FETCH_HEAD FROM base AS rootlesskit-build diff --git a/hack/dockerfile/install/rootlesskit.installer b/hack/dockerfile/install/rootlesskit.installer index 7540f5a487090..de6846ae17fa2 100755 --- a/hack/dockerfile/install/rootlesskit.installer +++ b/hack/dockerfile/install/rootlesskit.installer @@ -1,7 +1,7 @@ #!/bin/sh # When updating, also update vendor.mod and Dockerfile accordingly. -: "${ROOTLESSKIT_VERSION:=v2.0.1}" +: "${ROOTLESSKIT_VERSION:=v2.0.2}" install_rootlesskit() { case "$1" in From d27fe2558dcede92e30a7c4db0e779248d9b2c58 Mon Sep 17 00:00:00 2001 From: Akihiro Suda Date: Wed, 6 Mar 2024 07:43:00 +0900 Subject: [PATCH 2/2] dockerd-rootless-setuptool.sh: check RootlessKit functionality MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit RootlessKit will print hints if something is still unsatisfied. e.g., `kernel.apparmor_restrict_unprivileged_userns` constraint rootless-containers/rootlesskit@33c3e7ca6c3f76e74e8acd5b53668dcd3d8e58e0 Signed-off-by: Akihiro Suda (cherry picked from commit b32cfc3b3a9d791ed3924ab168f27962dceec949) Signed-off-by: Paweł Gronowski --- contrib/dockerd-rootless-setuptool.sh | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/contrib/dockerd-rootless-setuptool.sh b/contrib/dockerd-rootless-setuptool.sh index ed9b664ba9519..4a9ae75baeae7 100755 --- a/contrib/dockerd-rootless-setuptool.sh +++ b/contrib/dockerd-rootless-setuptool.sh @@ -269,6 +269,13 @@ init() { # - sysctl: "net.ipv4.ip_unprivileged_port_start" # - external binary: slirp4netns # - external binary: fuse-overlayfs + + # check RootlessKit functionality. RootlessKit will print hints if something is still unsatisfied. + # (e.g., `kernel.apparmor_restrict_unprivileged_userns` constraint) + if ! rootlesskit true; then + ERROR "RootlessKit failed, see the error messages and https://rootlesscontaine.rs/getting-started/common/ ." + exit 1 + fi } # CLI subcommand: "check"