deploy_rootlessdocker.sh
· 1.8 KiB · Bash
Originalformat
#!/bin/bash
# wget https://gist.githubusercontent.com/waja/0deb4dd5cd759371270dc3e1f5dabcb5/raw/deploy_rootlessdocker.sh -O /tmp/a && sh /tmp/a
# Check if dockerd is installed
[ $(which dockerd) ] || wget https://gist.githubusercontent.com/waja/01ba2641f93f461044f9/raw/docker_deploy.sh \
-O /tmp/docker_deploy.sh && bash /tmp/docker_deploy.sh
# Stop and disable dockerd (runs as root)
systemctl stop docker && systemctl disable docker
# Install curl and needed (new) slirp4netns
apt update && apt install -y curl && \
apt -t buster-backports install -y slirp4netns
# Download and install docker rootless
tmp=$(mktemp -d)
trap "rm -rf $tmp" EXIT INT TERM
STATIC_RELEASE_ROOTLESS_URL="https://master.dockerproject.org/linux/x86_64/docker-rootless-extras.tgz"
ROOTLESS_BIN="/usr/local/bin/"
cd "$tmp"
curl -L -o rootless.tgz "$STATIC_RELEASE_ROOTLESS_URL"
tar zxf "$tmp/rootless.tgz" -C "$ROOTLESS_BIN" --strip-components=1
# https://github.com/moby/moby/blob/master/docs/rootless.md#debian-gnulinux
# https://github.com/moby/moby/blob/master/docs/rootless.md#routing-ping-packets
cat <<EOF | sh -x
apt install -y uidmap
cat <<EOT > /etc/sysctl.d/50-docker-rootless.conf
kernel.unprivileged_userns_clone = 1
net.ipv4.ping_group_range = 0 2147483647
EOT
sysctl --system
EOF
# https://github.com/moby/moby/blob/master/docs/rootless.md#debian-gnulinux
# Make use of overlay2 storage
cat <<EOF > /etc/modprobe.d/docker-rootless.conf
options overlay permit_mounts_in_userns=1
EOF
# Set some environment variables and create needed directory
cat <<EOF > /etc/profile.d/docker-rootless.sh
export XDG_RUNTIME_DIR=/tmp/docker-\${UID}
[ -d \${XDG_RUNTIME_DIR} ] || mkdir \${XDG_RUNTIME_DIR}
export DOCKER_HOST=unix:///tmp/docker-\${UID}/docker.sock
export PATH=\$PATH:/sbin
alias dockerd-rootless='dockerd-rootless.sh --experimental --storage-driver overlay2'
EOF
| 1 | #!/bin/bash |
| 2 | # wget https://gist.githubusercontent.com/waja/0deb4dd5cd759371270dc3e1f5dabcb5/raw/deploy_rootlessdocker.sh -O /tmp/a && sh /tmp/a |
| 3 | |
| 4 | # Check if dockerd is installed |
| 5 | [ $(which dockerd) ] || wget https://gist.githubusercontent.com/waja/01ba2641f93f461044f9/raw/docker_deploy.sh \ |
| 6 | -O /tmp/docker_deploy.sh && bash /tmp/docker_deploy.sh |
| 7 | |
| 8 | # Stop and disable dockerd (runs as root) |
| 9 | systemctl stop docker && systemctl disable docker |
| 10 | |
| 11 | # Install curl and needed (new) slirp4netns |
| 12 | apt update && apt install -y curl && \ |
| 13 | apt -t buster-backports install -y slirp4netns |
| 14 | |
| 15 | # Download and install docker rootless |
| 16 | tmp=$(mktemp -d) |
| 17 | trap "rm -rf $tmp" EXIT INT TERM |
| 18 | STATIC_RELEASE_ROOTLESS_URL="https://master.dockerproject.org/linux/x86_64/docker-rootless-extras.tgz" |
| 19 | ROOTLESS_BIN="/usr/local/bin/" |
| 20 | cd "$tmp" |
| 21 | curl -L -o rootless.tgz "$STATIC_RELEASE_ROOTLESS_URL" |
| 22 | tar zxf "$tmp/rootless.tgz" -C "$ROOTLESS_BIN" --strip-components=1 |
| 23 | |
| 24 | # https://github.com/moby/moby/blob/master/docs/rootless.md#debian-gnulinux |
| 25 | # https://github.com/moby/moby/blob/master/docs/rootless.md#routing-ping-packets |
| 26 | cat <<EOF | sh -x |
| 27 | apt install -y uidmap |
| 28 | cat <<EOT > /etc/sysctl.d/50-docker-rootless.conf |
| 29 | kernel.unprivileged_userns_clone = 1 |
| 30 | net.ipv4.ping_group_range = 0 2147483647 |
| 31 | EOT |
| 32 | sysctl --system |
| 33 | EOF |
| 34 | |
| 35 | # https://github.com/moby/moby/blob/master/docs/rootless.md#debian-gnulinux |
| 36 | # Make use of overlay2 storage |
| 37 | cat <<EOF > /etc/modprobe.d/docker-rootless.conf |
| 38 | options overlay permit_mounts_in_userns=1 |
| 39 | EOF |
| 40 | |
| 41 | # Set some environment variables and create needed directory |
| 42 | cat <<EOF > /etc/profile.d/docker-rootless.sh |
| 43 | export XDG_RUNTIME_DIR=/tmp/docker-\${UID} |
| 44 | [ -d \${XDG_RUNTIME_DIR} ] || mkdir \${XDG_RUNTIME_DIR} |
| 45 | export DOCKER_HOST=unix:///tmp/docker-\${UID}/docker.sock |
| 46 | export PATH=\$PATH:/sbin |
| 47 | alias dockerd-rootless='dockerd-rootless.sh --experimental --storage-driver overlay2' |
| 48 | EOF |
| 49 |