Docker Engine 29.8 can render docker-default from a daemon-configured Go
template.
Document the supported template data, safe file placement, daemon
configuration, and verification so administrators do not treat the
template as a directly loadable profile.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The steps above already link the Notary service guide. The production
section still said to wait for an official stable release.
Fixes#25145
Signed-off-by: Dean Chen <862469039@qq.com>
The seccomp guide did not explain where relative profile paths are resolved or which host must contain the file. Document that the Docker CLI resolves and reads the path before sending the profile contents to the daemon.
Co-Authored-By: Codex <noreply@openai.com>
Fixes#23664.
The rootless docs compared rootless to userns-remap only in terms of
daemon privileges, never mentioning that the container-to-host UID
mapping also differs. Adds a short bullet list after the existing
comparison to spell it out and note the practical impact on bind-mount
file ownership.
- VPNKit is no longer installed
- `docker run --net=host` is available since v29.5
- Add `lxc-user-nic` hints
Follow-up to PR 24645
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
"`IPAddress` shown in `docker inspect` is unreachable" is not a historical limitation
and still holds true in Docker Engine v29.5 and later.
When I wrote this section, I probably confused the topic with the source IP address
propagation issue with `docker run -p` which is fixed in Docker Engine v29.5.
Follow-up to PR 24645
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Docker Engine ships RootlessKit v3.0.0 (per moby/moby Dockerfile), and
v3.0.0 is also the latest upstream release. Pinning to v3.0.0 keeps the
linked content aligned with the binary the reader actually has, while
still being current. Avoids the master-branch risk of mentioning
post-release features that aren't in the shipped binary.
The RootlessKit network and port docs were linked at the v2.0.0 tag, so
readers had no way to tell whether the linked content reflects current
RootlessKit behavior or a frozen older snapshot. Linking to the master
branch (default branch on rootless-containers/rootlesskit, verified) so
the references stay current as upstream evolves.
Closes#24941
Add `socket` and `socketcall` entries to the "Significant syscalls
blocked by the default profile" table to reflect the seccomp profile
changes that block AF_ALG sockets (CVE-2026-31431) and deny the
socketcall multiplexer to prevent bypassing address family filters.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The userns-remap page had no mention of rootless mode, so users didn't
know about the alternative. Added a note clarifying that userns-remap
still runs the daemon as root, with a link to rootless mode. The
rootless page already links back to userns-remap.
Co-Authored-By: Claude <noreply@anthropic.com>
The io_uring_enter, io_uring_register, and io_uring_setup syscalls were
removed from Docker's default seccomp allowlist in moby/moby#46762 due
to security vulnerabilities that can be exploited to escape containers.
Add them to the significant blocked syscalls table.
Fixes#23784
<!--Delete sections as needed -->
https://docs.docker.com/engine/security/rootless/ was too lengthy and
giving a false sense that Rootless mode was quite clunky and hard to
use, although actually it can be just set up in a single command:
```
dockerd-rootless-setuptool.sh install
```
## Description
<!-- Tell us what you did and why -->
### Commit 1: `engine/security/rootless: split to multiple pages`
This commit only splits the page.
The content will be updated in subsequent commits.
### Commit 2: `engine/security/rootless: remove outdated/duplicated
info`
Setup:
- `dockerd-rootless-setuptool.sh` has been improved to show help when
the prerequisites are not satisfied.
Users no longer need to read the **lengthy** "prerequisites"
documentation unless they encounter issues.
- The document had duplicated descriptions about dbus, uidmap, and
machinectl stuffs in several places.
Graph drivers:
- Rootless OverlayFS has been merged into the upstream since kernel
5.11:
torvalds/linux@459c7c565a .
Ubuntu no longer patches the kernel.
- FUSE-OverlayFS is typically no longer needed on the current supported
distros,
except EL 8.
SELinux:
- Remove a workaround for an issue that was already fixed in Docker
Engine v20.10.8.
CLI:
- `docker context use rootless` no longer needs to be executed manually,
since Docker v23. (moby/moby#43061)
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [X] Technical review
- [X] Editorial review
- [ ] Product review
## Preview
https://deploy-preview-23302--docsdocker.netlify.app/engine/security/rootless/
---------
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Co-authored-by: Paweł Gronowski <me@woland.xyz>
Co-authored-by: Allie Sadler <102604716+aevesdocker@users.noreply.github.com>
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
Fix a few grammar and spelling errors.
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
Debian 10 is no longer a supported version,
per content/manuals/engine/install/debian.md#os-requirements
Signed-off-by: Sebastian Yaghoubi <sebastianyaghoubi@gmail.com>
