Hardening Docker Daemon with Rootless Mode

on YouTube ↗22m

" summary

Runs the entire Docker stack as an unprivileged user so container escapes cannot gain real root on the host; installation is a single script and one env var (get.docker.com/rootless). Previous 19.03 lacks cgroups and OverlayFS; Docker 20.0x adds cgroup v2 support and a FUSE-OverlayFS backend so --cpus/--memory work. Networking uses user-mode stacks like slirp4netns or VPNKit (lxc-user-nic is experimental). Limits: no AppArmor profiles, no --net=host, privileged ports <1024.

AI-written summary · about

" chapters (10)

1. 0:00Introduction to rootless mode
2. 1:32Security architecture basics
3. 2:57Mitigating container attacks
4. 5:06Comparing security modes
5. 6:41Rootless mode demonstration
6. 8:37Getting started and setup
7. 11:08Under the hood mechanics
8. 14:09Networking and resource limits
9. 16:44Frequently asked questions
10. 19:19Conclusion and resources

" related talks

• 14mcontainerd: Rootless Containers 2020Akihiro Suda · KubeCon + CloudNativeCon North America 2020 Virtual
• 44mRootless containersAkihiro Suda, Giuseppe Scrivano · DevConf.CZ 2019
• 31mTowards unprivileged container buildsAlban Crequy · ContainerDays Hamburg 2018
• 33mContainers Security Layers and How Not to Break themAviv Sasson · ContainerCon @ Open Source Summit North America 2022
• 35mThe Reality of Rootless ContainersAjitem Sahasrabuddhe · ContainerDays Hamburg 2026
• 31mWhat’s under the hood of Docker?Janos Pasztor · DevOps Pro Europe 2019
• 32mThe Route To Rootless ContainersEd King, Julz Friedman · KubeCon + CloudNativeCon Europe 2018
• 30mThe Route To Rootless ContainersClaudia Beresford · Container Camp UK 2018