Rootless docker

Works on Ubuntu 24.04

https://docs.docker.com/engine/security/rootless/

install-rootless-docker-on-ubuntu.sh

#!/bin/bash
set -e

SERVICE_USER="dockeruser"

# 1. Ensure script is run with sudo/root privileges
if [[ $EUID -ne 0 ]]; then
   echo "Error: This script must be run as root. Try using: sudo $0"
   exit 1
fi

# ==========================================
# 2. PRE-SCRIPT SECTION
# ==========================================
echo "==> Running pre-installation tasks..."
# Add any commands you want to run before the setup begins right here.
# For example, you could source an external script if it exists:
# if [ -f "./pre-install.sh" ]; then
#     source ./pre-install.sh
# fi
#
# apt-get remove -y docker.io || true  # Example: remove old conflicting packages


# ==========================================
# 3. DOCKER-CE & DEPENDENCY INSTALLATION
# ==========================================
echo "==> Setting up Docker's official apt repository..."
apt-get update
apt-get install -y ca-certificates curl
install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
chmod a+r /etc/apt/keyrings/docker.asc

echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
  $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
  tee /etc/apt/sources.list.d/docker.list > /dev/null

echo "==> Installing docker-ce and rootless dependencies..."
apt-get update
apt-get install -y \
  docker-ce docker-ce-cli containerd.io \
  docker-buildx-plugin docker-compose-plugin \
  docker-ce-rootless-extras uidmap dbus-user-session slirp4netns


# ==========================================
# 4. SYSTEM CONFIGURATION & ROOTLESS SETUP
# ==========================================
echo "==> Configuring Ubuntu 24.04 unprivileged user namespaces..."
sysctl -w kernel.unprivileged_userns_clone=1
echo "kernel.unprivileged_userns_clone=1" > /etc/sysctl.d/50-rootless-docker.conf

echo "==> Stopping and disabling rootful Docker to prevent socket conflicts..."
systemctl stop docker.service docker.socket || true
systemctl disable docker.service docker.socket || true
rm -f /var/run/docker.sock

echo "==> Creating dedicated user: $SERVICE_USER..."
if id "$SERVICE_USER" &>/dev/null; then
    echo "User $SERVICE_USER already exists, skipping creation."
else
    useradd -m -s /bin/bash "$SERVICE_USER"
    echo "User $SERVICE_USER created successfully."
fi

echo "==> Enabling user lingering (ensures containers run without active SSH session)..."
loginctl enable-linger "$SERVICE_USER"

# Wait a moment for systemd to initialize the new user's DBUS environment
sleep 2

echo "==> Installing Rootless Docker as $SERVICE_USER..."
sudo -i -u "$SERVICE_USER" bash << 'EOF'
    # Define systemd runtime variables for the user session
    export XDG_RUNTIME_DIR="/run/user/$(id -u)"
    export DBUS_SESSION_BUS_ADDRESS="unix:path=${XDG_RUNTIME_DIR}/bus"

    # Run the rootless installer
    dockerd-rootless-setuptool.sh install

    # Configure .bashrc for future logins
    if ! grep -q "DOCKER_HOST" ~/.bashrc; then
        echo 'export DOCKER_HOST=unix:///run/user/$(id -u)/docker.sock' >> ~/.bashrc
        echo 'export PATH=/usr/bin:$PATH' >> ~/.bashrc
    fi

    # Start and enable the systemd service for Docker
    systemctl --user enable --now docker

    echo "==> Rootless Docker installed successfully for $(whoami)!"
    docker info | grep -i rootless
EOF

echo "==> Script complete!"
echo "To manage your containers, switch to the new user by running:"
echo "sudo su - $SERVICE_USER"