Docker Rootless Mode: Running Containers Without Root Privileges for Better Security

Overview

A hands-on guide to docker rootless mode: running containers without root privileges for better security, with step-by-step instructions, configuration examples, and troubleshooting advice for production environments.

Prerequisites

• Ubuntu 22.04 or later (Debian 11/12 compatible)
• Root or sudo access
• Familiarity with the Linux command line

Getting Started

Check your current system state before making changes:

uname -a
systemctl status
df -h && free -m

Core Implementation

# Install required packages
sudo apt update && sudo apt install -y relevant-packages

# Create configuration
sudo mkdir -p /etc/docker/rootless/mode/setup

Verification Steps

After each change, verify it works:

sudo systemctl restart relevant-service
journalctl -u relevant-service -n 20 --no-pager
sudo systemctl status relevant-service

Troubleshooting

Common issues and their fixes:

• Permission denied: Check file ownership and permissions with ls -la
• Port in use: Run ss -tlnp | grep :PORT and stop conflicting services
• Config syntax error: Use service-specific validation commands before restarting

Monitoring

For production environments, set up:

• Prometheus metrics for key performance indicators
• Alert rules for error rates and resource thresholds
• Log aggregation to track issues over time

Security

• Always run services under non-root users
• Restrict network binding to localhost when possible
• Enable audit logging
• Apply the principle of least privilege to all configurations