Skip to content

docker: run rootless as the current user without requiring sudo #1319

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
crazy-max merged 1 commit into from
Sep 11, 2026
Merged

docker: run rootless as the current user without requiring sudo #1319

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion __tests__/docker/install.test.itg.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,9 +61,10 @@ describe('rootless', () => {
return;
}
await ensureNoSystemContainerd();
const runDir = tmpDir();
const install = new Install({
source: source,
runDir: tmpDir(),
runDir: runDir,
contextName: 'foo',
daemonConfig: `{"debug":true}`,
rootless: true
Expand All @@ -74,8 +75,10 @@ describe('rootless', () => {
expect(out.exitCode).toBe(0);
expect(out.stderr.trim()).toBe('');
expect(out.stdout.trim()).toContain('rootless');
expect(fs.statSync(path.join(runDir, 'docker.pid')).uid).toBe(os.userInfo().uid);
})
).resolves.not.toThrow();
expect(fs.existsSync(runDir)).toBe(false);
},
30 * 60 * 1000
);
Expand Down
21 changes: 11 additions & 10 deletions src/docker/install.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -395,25 +395,22 @@ export class Install {
let dockerPath = `${this.toolDir}/dockerd`;
if (this.rootless) {
dockerPath = `${this.toolDir}/dockerd-rootless.sh`;
if (fs.existsSync('/proc/sys/kernel/apparmor_restrict_unprivileged_userns')) {
await Exec.exec('sudo', ['sh', '-c', 'echo 0 > /proc/sys/kernel/apparmor_restrict_unprivileged_userns']);
if (process.env.RUNNER_ENVIRONMENT === 'github-hosted' && fs.existsSync('/proc/sys/kernel/apparmor_restrict_unprivileged_userns') && (await io.which('sudo', false))) {
await Exec.exec('sudo', ['-n', 'sh', '-c', 'echo 0 > /proc/sys/kernel/apparmor_restrict_unprivileged_userns'], {ignoreReturnCode: true});
}
}
let cmd = `${dockerPath} --host="${dockerHost}" --config-file="${daemonConfigPath}" --exec-root="${this.runDir}/execroot" --data-root="${this.runDir}/data" --pidfile="${this.runDir}/docker.pid"`;
if (this.localTCPPort) {
cmd += ` --host="tcp://127.0.0.1:${this.localTCPPort}"`;
}
core.info(`[command] ${cmd}`); // https://github.com/actions/toolkit/blob/3d652d3133965f63309e4b2e1c8852cdbdcb3833/packages/exec/src/toolrunner.ts#L47
let sudo = 'sudo';
if (this.rootless) {
sudo += ' -u \\#1001';
}
const sudo = this.rootless ? '' : 'sudo ';
const proc = await child_process.spawn(
// We can't use Exec.exec here because we need to detach the process to
// avoid killing it when the action finishes running. Even if detached,
// we also need to run dockerd in a subshell and unref the process so
// GitHub Action doesn't wait for it to finish.
`${sudo} env "PATH=$PATH" "XDG_RUNTIME_DIR=$XDG_RUNTIME_DIR" ${bashPath} << EOF
`${sudo}env "PATH=$PATH" "XDG_RUNTIME_DIR=$XDG_RUNTIME_DIR" ${bashPath} << EOF
( ${cmd} 2>&1 | tee "${this.runDir}/dockerd.log" ) &
EOF`,
[],
Expand Down Expand Up @@ -588,17 +585,21 @@ EOF`,

private async tearDownLinux(): Promise<void> {
await core.group('Docker daemon logs', async () => {
await Exec.exec('sudo', ['cat', path.join(this.runDir, 'dockerd.log')], {ignoreReturnCode: true});
const args = [path.join(this.runDir, 'dockerd.log')];
await Exec.exec(this.rootless ? 'cat' : 'sudo', this.rootless ? args : ['cat', ...args], {ignoreReturnCode: true});

@vvoland vvoland Sep 11, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will require a follow up in setup-docker-action to also pass rootless to new Install for the teardown:

https://github.com/docker/setup-docker-action/blob/77e84dbf09b47d1e29270283c22f16145aa85ca1/src/main.ts#L101-L104

(it's really fishy that we just don't use the same object for both though!)

@crazy-max crazy-max Sep 11, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch, I missed the separate construction in post. I'll pass the rootless input there when updating the toolkit dependency. Main and post run in separate processes, so we need to reconstruct the instance, but the teardown options should match.

});
await core.group('Stopping Docker daemon', async () => {
await Exec.exec('sudo', ['kill', '-s', 'SIGTERM', fs.readFileSync(path.join(this.runDir, 'docker.pid')).toString().trim()]);
const args = ['-s', 'SIGTERM', fs.readFileSync(path.join(this.runDir, 'docker.pid')).toString().trim()];
await Exec.exec(this.rootless ? 'kill' : 'sudo', this.rootless ? args : ['kill', ...args]);
await Util.sleep(5);
});
await core.group('Removing Docker context', async () => {
await Docker.exec(['context', 'rm', '-f', this.contextName]);
});
await core.group(`Cleaning up runDir`, async () => {
await Exec.exec('sudo', ['rm', '-rf', this.runDir], {
// Rootless image files can be owned by subordinate UIDs, so remove them
// inside the same user namespace mapping used by the daemon.
await Exec.exec(this.rootless ? 'rootlesskit' : 'sudo', ['rm', '-rf', this.runDir], {
ignoreReturnCode: true,
failOnStdErr: false
});
Expand Down
Loading