The DevOps team at Mir Plat.Form implemented Rootless Docker to facilitate the migration of Jenkins to Kubernetes and the deployment of ephemeral agents. This approach addresses security risks associated with the traditional Docker daemon, which typically operates with root privileges.
Rootless mode shifts the entire Docker stack—including the daemon, runtimes, and utilities—to run under a non-privileged user. This prevents potential system-wide compromises if a container is breached or if a configuration error occurs.
The implementation relies on User Namespaces (UserNS) for UID/GID mapping and slirp4netns for network stack emulation. File system operations are handled via fuse-overlayfs, while newuidmap and newgidmap manage identifier mappings.
For proper operation within Kubernetes pods, the team recommends running Docker as a systemd unit using the dockerd-rootless-setuptool.sh script. This ensures correct cgroup configuration, which is essential for Jenkins plugins like withDockerContainer to function correctly.
Installation involves the docker-ce-rootless-extras package. Post-installation requires configuring environment variables, specifically DOCKER_HOST and PATH, and enabling the user-level systemd service with loginctl linger to ensure the daemon persists.
