Fixes#23664.
The rootless docs compared rootless to userns-remap only in terms of
daemon privileges, never mentioning that the container-to-host UID
mapping also differs. Adds a short bullet list after the existing
comparison to spell it out and note the practical impact on bind-mount
file ownership.
- VPNKit is no longer installed
- `docker run --net=host` is available since v29.5
- Add `lxc-user-nic` hints
Follow-up to PR 24645
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
"`IPAddress` shown in `docker inspect` is unreachable" is not a historical limitation
and still holds true in Docker Engine v29.5 and later.
When I wrote this section, I probably confused the topic with the source IP address
propagation issue with `docker run -p` which is fixed in Docker Engine v29.5.
Follow-up to PR 24645
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Docker Engine ships RootlessKit v3.0.0 (per moby/moby Dockerfile), and
v3.0.0 is also the latest upstream release. Pinning to v3.0.0 keeps the
linked content aligned with the binary the reader actually has, while
still being current. Avoids the master-branch risk of mentioning
post-release features that aren't in the shipped binary.
The RootlessKit network and port docs were linked at the v2.0.0 tag, so
readers had no way to tell whether the linked content reflects current
RootlessKit behavior or a frozen older snapshot. Linking to the master
branch (default branch on rootless-containers/rootlesskit, verified) so
the references stay current as upstream evolves.
Closes#24941
<!--Delete sections as needed -->
https://docs.docker.com/engine/security/rootless/ was too lengthy and
giving a false sense that Rootless mode was quite clunky and hard to
use, although actually it can be just set up in a single command:
```
dockerd-rootless-setuptool.sh install
```
## Description
<!-- Tell us what you did and why -->
### Commit 1: `engine/security/rootless: split to multiple pages`
This commit only splits the page.
The content will be updated in subsequent commits.
### Commit 2: `engine/security/rootless: remove outdated/duplicated
info`
Setup:
- `dockerd-rootless-setuptool.sh` has been improved to show help when
the prerequisites are not satisfied.
Users no longer need to read the **lengthy** "prerequisites"
documentation unless they encounter issues.
- The document had duplicated descriptions about dbus, uidmap, and
machinectl stuffs in several places.
Graph drivers:
- Rootless OverlayFS has been merged into the upstream since kernel
5.11:
torvalds/linux@459c7c565a .
Ubuntu no longer patches the kernel.
- FUSE-OverlayFS is typically no longer needed on the current supported
distros,
except EL 8.
SELinux:
- Remove a workaround for an issue that was already fixed in Docker
Engine v20.10.8.
CLI:
- `docker context use rootless` no longer needs to be executed manually,
since Docker v23. (moby/moby#43061)
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [X] Technical review
- [X] Editorial review
- [ ] Product review
## Preview
https://deploy-preview-23302--docsdocker.netlify.app/engine/security/rootless/
---------
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Co-authored-by: Paweł Gronowski <me@woland.xyz>
Co-authored-by: Allie Sadler <102604716+aevesdocker@users.noreply.github.com>
