2 Commits

Author SHA1 Message Date
David Karlsson
6e8ef4cf21 engine: safer creation of rootlesskit apparmor profile
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
2025-11-19 15:38:53 +01:00
Akihiro Suda
89344f43f1 engine/security/rootless: split to multiple pages ; remove outdated/duplicated info (#23302)
<!--Delete sections as needed -->

https://docs.docker.com/engine/security/rootless/ was too lengthy and
giving a false sense that Rootless mode was quite clunky and hard to
use, although actually it can be just set up in a single command:
```
dockerd-rootless-setuptool.sh install
```

## Description

<!-- Tell us what you did and why -->

### Commit 1: `engine/security/rootless: split to multiple pages`
This commit only splits the page.
The content will be updated in subsequent commits.

### Commit 2: `engine/security/rootless: remove outdated/duplicated
info`

Setup:
- `dockerd-rootless-setuptool.sh` has been improved to show help when
the prerequisites are not satisfied.
Users no longer need to read the **lengthy** "prerequisites"
documentation unless they encounter issues.

- The document had duplicated descriptions about dbus, uidmap, and
machinectl stuffs in several places.

Graph drivers:
- Rootless OverlayFS has been merged into the upstream since kernel
5.11:
  torvalds/linux@459c7c565a .
  Ubuntu no longer patches the kernel.

- FUSE-OverlayFS is typically no longer needed on the current supported
distros,
  except EL 8.

SELinux:
- Remove a workaround for an issue that was already fixed in Docker
Engine v20.10.8.

CLI:
- `docker context use rootless` no longer needs to be executed manually,
  since Docker v23. (moby/moby#43061)

## Related issues or tickets

<!-- Related issues, pull requests, or Jira tickets -->

## Reviews

<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->

- [X] Technical review
- [X] Editorial review
- [ ] Product review


## Preview

https://deploy-preview-23302--docsdocker.netlify.app/engine/security/rootless/

---------

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Co-authored-by: Paweł Gronowski <me@woland.xyz>
Co-authored-by: Allie Sadler <102604716+aevesdocker@users.noreply.github.com>
2025-09-08 10:19:18 +01:00