Run Docker in rootless mode

The fix

# As the unprivileged user who will own the containers:
dockerd-rootless-setuptool.sh install

export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/docker.sock
systemctl --user enable --now docker

Why it matters

Every other page in this cluster narrows what a container can do to a host whose daemon runs as root. Rootless mode removes the root daemon.

dockerd runs as your unprivileged user inside a user namespace. Container root maps to your UID on the host, not to real root. That changes the arithmetic on the thing this whole cluster is built around:

• The socket is no longer root-equivalent. It lives in $XDG_RUNTIME_DIR/docker.sock and grants your privileges, not root’s.
• The docker group problem disappears, because there’s no root daemon to be a member of.
• A container escape lands as you, not as root. It’s still bad — your files, your keys — but it isn’t the machine.

This is the only structural fix on the list. Everything else is mitigation.

What it costs

Rootless is production-ready and has been for years, but it is not free, and the honest list matters:

• Ports below 1024 need a workaround. An unprivileged process can’t bind them. Either publish high ports and put a reverse proxy in front, or grant CAP_NET_BIND_SERVICE to rootlesskit.
• No AppArmor, and cgroup controls depend on cgroup v2 with delegation configured. On cgroup v1 you get no resource limits at all.
• Networking is slower and different. Docker 29.5 changed the default rootless network driver from slirp4netns to gvisor-tap-vsock; both are userspace network stacks and neither matches native bridge throughput.
• Overlay networks and some storage drivers have limits or don’t work.
• --privileged, --network=host and --pid=host behave differently or not at all — which is mostly the point, but it does break things.

For a web application, none of these matter. For a CI runner doing exotic networking, some will.

Podman may be the shorter path

Worth saying plainly rather than burying: if you are on RHEL, Fedora or CentOS, Podman 5.x is already installed and is rootless by default. Red Hat ships and supports it, and there is no daemon at all — containers are child processes of your shell, so there is no socket to protect and no daemon to compromise.

Podman is largely CLI-compatible (alias docker=podman covers a lot), reads the same images, and RHEL 9.5+ uses pasta for rootless networking. podman generate systemd produces proper unit files, which is genuinely nicer than Docker’s restart policies.

That’s not a recommendation to migrate a working Docker install. It is a recommendation to check what’s already on the box before doing the work of retrofitting rootless Docker onto a distro that ships a rootless-by-default alternative.

Verify it worked

Check whether you’re on rootless right now:

docker info --format '{{.SecurityOptions}}'

Look for name=rootless. Its absence means the daemon is root.

Confirm which daemon you’re talking to — the variable is what decides:

echo $DOCKER_HOST
ps -o user,args -C dockerd

dockerd running as your user is rootless; running as root is not. Both can exist on the same machine at once, and DOCKER_HOST picks which one you get — that’s the most common source of “I installed rootless but it’s still root”.

Prove the isolation, which is the whole point:

docker run --rm -v /tmp/rootless-demo:/data alpine sh -c 'id; touch /data/f'
ls -l /tmp/rootless-demo/f

Under rootless, that file is owned by you, not by root. Compare to the same test under a rootful daemon, where it’s root-owned.

Check the socket:

ls -l $XDG_RUNTIME_DIR/docker.sock

Owned by you, in your runtime directory — not /var/run/docker.sock.

Before you apply this

This is a migration, not a flag. Rootless Docker uses a separate daemon with separate storage: your existing images, volumes and containers are not visible to it. Nothing is deleted, but nothing carries over either — you re-pull images and re-create containers, and any data in a named volume needs copying out and back.

Plan for that rather than discovering it:

# rootful (as root) — export what matters
sudo docker run --rm -v myvolume:/from -v /tmp:/to alpine \
  tar czf /to/myvolume.tgz -C /from .

Check the prerequisites before you start, because the failure is a confusing setup error rather than a clear message:

grep -c . /etc/subuid /etc/subgid          # need entries for your user
cat /sys/fs/cgroup/cgroup.controllers      # need cgroup v2 for resource limits

Missing /etc/subuid and /etc/subgid ranges are the usual first stumble.

Don’t run both daemons and forget. A rootful daemon left running alongside is still a root socket on the box, and the group is still root. Migrating to rootless and leaving the old daemon enabled achieves nothing:

sudo systemctl disable --now docker.service docker.socket

Only do that once everything is migrated and verified — it stops every rootful container on the host.

Ports below 1024 fail immediately and the error is a bind failure. Decide the answer up front: high port plus reverse proxy is the clean one.

Related

• Protect the Docker socket — the problem this solves.
• Container escape — what changes when the daemon isn’t root.