1

I am currently trying to run the docker daemon in rootless mode according to the documentation: https://docs.docker.com/engine/security/rootless/

While this netcat command was working when docker was run the "normal way", e.g. with:
sudo docker run --rm -it --name custom <options> <image> bash:

(depending on the docker image you try, you may have to install the netcat package inside the container at this stage)

root@a390456c8d0b:/# nc -vz 172.17.0.1 5432
Connection to 172.17.0.1 5432 port [tcp/postgresql] succeeded!

it is not working with the rootless mode:

root@a390456c8d0b:/# nc -vr 172.17.0.1 5432
nc: connect to 172.17.0.1 port 5432 (tcp) failed: Connection refused

It seems to me that the gateway 172.17.0.1 is only available/used when docker is run the normal way, with sudo, and not within the new rootless mode. But it's only a guess.

Does anybody know how to fix that and how I can ping any of the ports on the host machine (Ubuntu 21.10/22.04 dev) from any rootless docker container? (in the present case I ping the postgres default port 5432 but it can be whatever port of your choice).

Info:

$ docker --version
Docker version 20.10.12, build e91ed57

$ uname -mor
5.13.0-19-generic x86_64 GNU/Linux

When in rootless, status of the docker service is as follow:

$ systemctl --user status docker
● docker.service - Docker Application Container Engine (Rootless)
     Loaded: loaded (/home/sk/.config/systemd/user/docker.service; disabled; vendor preset: enabled)
     Active: active (running) since Sun 2022-01-02 21:59:07 CET; 25min ago
       Docs: https://docs.docker.com/go/rootless/
   Main PID: 37085 (rootlesskit)
      Tasks: 58
     Memory: 57.5M
        CPU: 5.553s
     CGroup: /user.slice/user-1000.slice/user@1000.service/app.slice/docker.service
             ├─37085 rootlesskit --net=slirp4netns --mtu=65520 --slirp4netns-sandbox=auto --slirp4netns-seccomp=auto --disable-host-loopback --port-driver=builtin --copy->
             ├─37096 /proc/self/exe --net=slirp4netns --mtu=65520 --slirp4netns-sandbox=auto --slirp4netns-seccomp=auto --disable-host-loopback --port-driver=builtin --co>
             ├─37114 slirp4netns --mtu 65520 -r 3 --disable-host-loopback --enable-sandbox --enable-seccomp 37096 tap0
             ├─37121 dockerd
             ├─37143 containerd --config /run/user/1000/docker/containerd/containerd.toml --log-level info
             └─37393 /usr/bin/containerd-shim-runc-v2 -namespace moby -id a370455c8d0bc3e2fd796e788d52d4315c06fc44befe38aa8eb5466f1128e787 -address /run/user/1000/docker/>

Jan 02 21:59:07 sk-Laptop dockerd-rootless.sh[37121]: time="2022-01-02T21:59:07.957623453+01:00" level=warning msg="Unable to find io controller"
Jan 02 21:59:07 sk-Laptop dockerd-rootless.sh[37121]: time="2022-01-02T21:59:07.957626649+01:00" level=warning msg="Unable to find cpuset controller"
Jan 02 21:59:07 sk-Laptop dockerd-rootless.sh[37121]: time="2022-01-02T21:59:07.957716164+01:00" level=info msg="Loading containers: start."
Jan 02 21:59:08 sk-Laptop dockerd-rootless.sh[37121]: time="2022-01-02T21:59:08.007912512+01:00" level=info msg="Default bridge (docker0) is assigned with an IP address 172.17.0.0/16. D>
Jan 02 21:59:08 sk-Laptop dockerd-rootless.sh[37121]: time="2022-01-02T21:59:08.077361354+01:00" level=info msg="Loading containers: done."
Jan 02 21:59:08 sk-Laptop dockerd-rootless.sh[37121]: time="2022-01-02T21:59:08.080978248+01:00" level=warning msg="Not using native diff for overlay2, this may cause degraded performan>
Jan 02 21:59:08 sk-Laptop dockerd-rootless.sh[37121]: time="2022-01-02T21:59:08.081081192+01:00" level=info msg="Docker daemon" commit=459d0df graphdriver(s)=overlay2 version=20.10.12
Jan 02 21:59:08 sk-Laptop dockerd-rootless.sh[37121]: time="2022-01-02T21:59:08.081102319+01:00" level=info msg="Daemon has completed initialization"
Jan 02 21:59:08 sk-Laptop dockerd-rootless.sh[37121]: time="2022-01-02T21:59:08.091292835+01:00" level=info msg="API listen on /run/user/1000/docker.sock"
Jan 02 22:00:30 sk-Laptop dockerd-rootless.sh[37143]: time="2022-01-02T22:00:30.603612706+01:00" level=info msg="starting signal loop" namespace=moby path=/run/.ro995659387/user/1000/do>

and when run with sudo, the systemctl output shows that the "root" daemon is not active, which is normal:

$ sudo systemctl status docker
○ docker.service - Docker Application Container Engine
     Loaded: loaded (/lib/systemd/system/docker.service; disabled; vendor preset: enabled)
     Active: inactive (dead)
TriggeredBy: ○ docker.socket
       Docs: https://docs.docker.com

Jan 02 21:55:39 sk-Laptop dockerd[36685]: time="2022-01-02T21:55:39.318284987+01:00" level=info msg="Daemon has completed initialization"
Jan 02 21:55:39 sk-Laptop systemd[1]: Started Docker Application Container Engine.
Jan 02 21:55:39 sk-Laptop dockerd[36685]: time="2022-01-02T21:55:39.329132562+01:00" level=info msg="API listen on /run/docker.sock"
Jan 02 21:56:14 sk-Laptop systemd[1]: Stopping Docker Application Container Engine...
Jan 02 21:56:14 sk-Laptop dockerd[36685]: time="2022-01-02T21:56:14.005854836+01:00" level=info msg="Processing signal 'terminated'"
Jan 02 21:56:14 sk-Laptop dockerd[36685]: time="2022-01-02T21:56:14.006211665+01:00" level=info msg="stopping event stream following graceful shutdown" error="<nil>" module=l>
Jan 02 21:56:14 sk-Laptop dockerd[36685]: time="2022-01-02T21:56:14.006356148+01:00" level=info msg="Daemon shutdown complete"
Jan 02 21:56:14 sk-Laptop dockerd[36685]: time="2022-01-02T21:56:14.006382673+01:00" level=info msg="stopping event stream following graceful shutdown" error="context cancele>
Jan 02 21:56:14 sk-Laptop systemd[1]: docker.service: Deactivated successfully.
Jan 02 21:56:14 sk-Laptop systemd[1]: Stopped Docker Application Container Engine.

1 Answer 1

1

The following is a theory, but I don't have a docker host to hand that I can put in rootless mode to test.

When run in rootless mode there are some limitations on what the docker daemon can do.

I don't know how they've achieved rootless networking at all, but it would make sense that rootless docker can't create the ususal docker interface directly in the host's namespace. In regular root mode docker I can see an interface when I type ip address:

4: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether 02:42:88:1f:3d:89 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever
    inet6 fe80::42:88ff:fe1f:3d89/64 scope link 
       valid_lft forever preferred_lft forever

My theory is that if docker can't create this then your problem isn't that you're unable to talk to the host machine but simply that your application (postgresql) isn't listening on 172.17.0.1. This may be an undocumented limitation of rootless mode docker.

Fortunately your application (postgresql) should still be listening on other IP addresses such as your LAN or WiFi ip address. If your docker container can reach the outside world (access anything from the internet) then it should be able to talk to your host machine on that IP.

You can use the command ip address to lookup your local ip address and then use that instead.

1
  • You seem right; each time I restart the computer, both docker daemons are not active, I always have to manually start it using systemctl --user status docker. And at that point, there is still no docker0 interface, indeed.
    – s.k
    Jan 3 at 18:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.