From d8477f9b0245a88559c77eba0ae594f6430921fa Mon Sep 17 00:00:00 2001 From: Jonh Wendell Date: Fri, 21 Apr 2017 20:43:56 -0300 Subject: [PATCH] Add a rootless containers section on README Closes #1413. Signed-off-by: Jonh Wendell --- README.md | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index ae1ab2819..a951f0db3 100644 --- a/README.md +++ b/README.md @@ -117,8 +117,8 @@ Assuming you have an OCI bundle from the previous step you can execute the conta The first way is to use the convenience command `run` that will handle creating, starting, and deleting the container after it exits. ```bash +# run as root cd /mycontainer - runc run mycontainerid ``` @@ -165,8 +165,8 @@ Now we can go though the lifecycle operations in your shell. ```bash +# run as root cd /mycontainer - runc create mycontainerid # view the container is created and in the "created" state @@ -185,6 +185,22 @@ runc delete mycontainerid This adds more complexity but allows higher level systems to manage runc and provides points in the containers creation to setup various settings after the container has created and/or before it is deleted. This is commonly used to setup the container's network stack after `create` but before `start` where the user's defined process will be running. +#### Rootless containers +`runc` has the ability to run containers without root privileges. This is called `rootless`. You need to pass some parameters to `runc` in order to run rootless containers. See below and compare with the previous version. Run the following commands as an ordinary user: +```bash +# Same as the first example +mkdir ~/mycontainer +cd ~/mycontainer +mkdir rootfs +docker export $(docker create busybox) | tar -C rootfs -xvf - + +# The --rootless parameter instructs runc spec to generate a configuration for a rootless container, which will allow you to run the container as a non-root user. +runc spec --rootless + +# The --root parameter tells runc where to store the container state. It must be writable by the user. +runc --root /tmp/runc run mycontainerid +``` + #### Supervisors `runc` can be used with process supervisors and init systems to ensure that containers are restarted when they exit.