Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.Sign up
Allow engine to run inside a user namespace #25672
Carry of PR #20902
Allow the Docker daemon to run inside a user namespaced parent process. Original patch by @hallyn; I've added a change to revert to "real" chroot when inside a userns that came about since the original patch.
I have tested this capability inside lxc running an ubuntu:xenial image with a binary built from this PR patchset. To successfully run the Docker daemon I used the following command line:
Inside a user namespace, writing to the oom_score_adj special proc file fails, and I can't get any backend driver to work outside of vfs.
I cannot run the Docker engine inside of a runc container with user namespaces enabled due to how the
referenced this pull request
Aug 12, 2016
LGTM but I think we should document the cant-create-devices restriction somewhere (probably dont need to mention the chroot) as it is not something people would necessarily realise. Plus the
@justincormack agree on the docs need..but where? Is that the same section as user namespaces support in the daemon, or some other place that talks about environment in which you run the daemon? Seems like it should be the latter, but that points to less clear locations as there are lots of various bits about running/configuring the engine.. any guidance appreciated! /cc @thaJeztah