containerd-rootless.sh

#!/bin/sh

#   Copyright The containerd Authors.

#   Licensed under the Apache License, Version 2.0 (the "License");
#   you may not use this file except in compliance with the License.
#   You may obtain a copy of the License at

#       http://www.apache.org/licenses/LICENSE-2.0

#   Unless required by applicable law or agreed to in writing, software
#   distributed under the License is distributed on an "AS IS" BASIS,
#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#   See the License for the specific language governing permissions and
#   limitations under the License.

# -----------------------------------------------------------------------------
# Forked from https://github.com/moby/moby/blob/v20.10.3/contrib/dockerd-rootless.sh
# Copyright The Moby Authors.
# Licensed under the Apache License, Version 2.0
# NOTICE: https://github.com/moby/moby/blob/v20.10.3/NOTICE
# -----------------------------------------------------------------------------

# containerd-rootless.sh executes containerd in rootless mode.
#
# Usage: containerd-rootless.sh [CONTAINERD_OPTIONS]
#
# External dependencies:
# * newuidmap and newgidmap needs to be installed.
# * /etc/subuid and /etc/subgid needs to be configured for the current user.
# * RootlessKit (>= v0.10.0) needs to be installed. RootlessKit >= v2.0.0 is recommended.
# * Either one of slirp4netns (>= v0.4.0), VPNKit, lxc-user-nic needs to be installed. slirp4netns >= v1.1.7 is recommended.
#
# Recognized environment variables:
# * CONTAINERD_ROOTLESS_ROOTLESSKIT_STATE_DIR=DIR: the rootlesskit state dir. Defaults to "$XDG_RUNTIME_DIR/containerd-rootless".
# * CONTAINERD_ROOTLESS_ROOTLESSKIT_NET=(slirp4netns|vpnkit|lxc-user-nic): the rootlesskit network driver. Defaults to "slirp4netns" if slirp4netns (>= v0.4.0) is installed. Otherwise defaults to "vpnkit".
# * CONTAINERD_ROOTLESS_ROOTLESSKIT_MTU=NUM: the MTU value for the rootlesskit network driver. Defaults to 65520 for slirp4netns, 1500 for other drivers.
# * CONTAINERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=(builtin|slirp4netns): the rootlesskit port driver. Defaults to "builtin".
# * CONTAINERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SANDBOX=(auto|true|false): whether to protect slirp4netns with a dedicated mount namespace. Defaults to "auto".
# * CONTAINERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SECCOMP=(auto|true|false): whether to protect slirp4netns with seccomp. Defaults to "auto".
# * CONTAINERD_ROOTLESS_ROOTLESSKIT_DETACH_NETNS=(auto|true|false): whether to launch rootlesskit with the "detach-netns" mode.
#   Defaults to "auto", which is resolved to "true" if RootlessKit >= 2.0 is installed.
#   The "detached-netns" mode accelerates `nerdctl (pull|push|build)` and enables `nerdctl run --net=host`,
#   however, there is a relatively minor drawback with BuildKit prior to v0.13:
#   the host loopback IP address (127.0.0.1) and abstract sockets are exposed to Dockerfile's "RUN" instructions during `nerdctl build` (not `nerdctl run`).
#   The drawback is fixed in BuildKit v0.13. Upgrading from a prior version of BuildKit needs removing the old systemd unit:
#   `containerd-rootless-setuptool.sh uninstall-buildkit && rm -f ~/.config/buildkit/buildkitd.toml`

# See also: https://github.com/containerd/nerdctl/blob/main/docs/rootless.md#configuring-rootlesskit

set -e
if ! [ -w "$XDG_RUNTIME_DIR" ]; then
	echo "XDG_RUNTIME_DIR needs to be set and writable"
	exit 1
fi
if ! [ -w "$HOME" ]; then
	echo "HOME needs to be set and writable"
	exit 1
fi
: "${XDG_DATA_HOME:=$HOME/.local/share}"
: "${XDG_CONFIG_HOME:=$HOME/.config}"

if [ -z "$_CONTAINERD_ROOTLESS_CHILD" ]; then
	if [ "$(id -u)" = "0" ]; then
		echo "Must not run as root"
		exit 1
	fi
	case "$1" in
	"check" | "install" | "uninstall")
		echo "Did you mean 'containerd-rootless-setuptool.sh $*' ?"
		exit 1
		;;
	esac

	: "${CONTAINERD_ROOTLESS_ROOTLESSKIT_STATE_DIR:=$XDG_RUNTIME_DIR/containerd-rootless}"
	: "${CONTAINERD_ROOTLESS_ROOTLESSKIT_NET:=}"
	: "${CONTAINERD_ROOTLESS_ROOTLESSKIT_MTU:=}"
	: "${CONTAINERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER:=builtin}"
	: "${CONTAINERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SANDBOX:=auto}"
	: "${CONTAINERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SECCOMP:=auto}"
	: "${CONTAINERD_ROOTLESS_ROOTLESSKIT_DETACH_NETNS:=auto}"
	net=$CONTAINERD_ROOTLESS_ROOTLESSKIT_NET
	mtu=$CONTAINERD_ROOTLESS_ROOTLESSKIT_MTU
	if [ -z "$net" ]; then
		if command -v slirp4netns >/dev/null 2>&1; then
			# If --netns-type is present in --help, slirp4netns is >= v0.4.0.
			if slirp4netns --help | grep -qw -- --netns-type; then
				net=slirp4netns
				if [ -z "$mtu" ]; then
					mtu=65520
				fi
			else
				echo "slirp4netns found but seems older than v0.4.0. Falling back to VPNKit."
			fi
		fi
		if [ -z "$net" ]; then
			if command -v vpnkit >/dev/null 2>&1; then
				net=vpnkit
			else
				echo "Either slirp4netns (>= v0.4.0) or vpnkit needs to be installed"
				exit 1
			fi
		fi
	fi
	if [ -z "$mtu" ]; then
		mtu=1500
	fi

	_CONTAINERD_ROOTLESS_CHILD=1
	export _CONTAINERD_ROOTLESS_CHILD

	# `selinuxenabled` always returns false in RootlessKit child, so we execute `selinuxenabled` in the parent.
	# https://github.com/rootless-containers/rootlesskit/issues/94
	if command -v selinuxenabled >/dev/null 2>&1; then
		if selinuxenabled; then
			_CONTAINERD_ROOTLESS_SELINUX=1
			export _CONTAINERD_ROOTLESS_SELINUX
		fi
	fi

	case "$CONTAINERD_ROOTLESS_ROOTLESSKIT_DETACH_NETNS" in
	auto)
		if  rootlesskit --help | grep -qw -- "--detach-netns"; then
			CONTAINERD_ROOTLESS_ROOTLESSKIT_FLAGS="--detach-netns $CONTAINERD_ROOTLESS_ROOTLESSKIT_FLAGS"
		fi
		;;
	1 | true)
		CONTAINERD_ROOTLESS_ROOTLESSKIT_FLAGS="--detach-netns $CONTAINERD_ROOTLESS_ROOTLESSKIT_FLAGS"
		;;
	0 | false)
		# NOP
		;;
	*)
		echo "Unknown CONTAINERD_ROOTLESS_ROOTLESSKIT_DETACH_NETNS value: $CONTAINERD_ROOTLESS_ROOTLESSKIT_DETACH_NETNS"
		exit 1
		;;
	esac

	# Re-exec the script via RootlessKit, so as to create unprivileged {user,mount,network} namespaces.
	#
	# --copy-up allows removing/creating files in the directories by creating tmpfs and symlinks
	# * /etc:     copy-up is required so as to prevent `/etc/resolv.conf` in the
	#             namespace from being unexpectedly unmounted when `/etc/resolv.conf` is recreated on the host
	#             (by either systemd-networkd or NetworkManager)
	# * /run:     copy-up is required so that we can create /run/containerd (hardcoded) in our namespace
	# * /var/lib: copy-up is required so that we can create /var/lib/containerd in our namespace
	# shellcheck disable=SC2086
	exec rootlesskit \
		--state-dir="$CONTAINERD_ROOTLESS_ROOTLESSKIT_STATE_DIR" \
		--net="$net" --mtu="$mtu" \
		--slirp4netns-sandbox="$CONTAINERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SANDBOX" \
		--slirp4netns-seccomp="$CONTAINERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SECCOMP" \
		--disable-host-loopback --port-driver="$CONTAINERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER" \
		--copy-up=/etc --copy-up=/run --copy-up=/var/lib \
		--propagation=rslave \
		$CONTAINERD_ROOTLESS_ROOTLESSKIT_FLAGS \
		"$0" "$@"
else
	[ "$_CONTAINERD_ROOTLESS_CHILD" = 1 ]
	# Remove the *symlinks* for the existing files in the parent namespace if any,
	# so that we can create our own files in our mount namespace.
	# The actual files in the parent namespace are *not removed* by this rm command.
	rm -f /run/containerd /run/xtables.lock \
		/var/lib/containerd /var/lib/cni /etc/containerd

	# Bind-mount /etc/ssl.
	# Workaround for "x509: certificate signed by unknown authority" on openSUSE Tumbleweed.
	# https://github.com/rootless-containers/rootlesskit/issues/225
	realpath_etc_ssl=$(realpath /etc/ssl)
	rm -f /etc/ssl
	mkdir /etc/ssl
	mount --rbind "${realpath_etc_ssl}" /etc/ssl

	# Bind-mount /run/containerd
	mkdir -p "${XDG_RUNTIME_DIR}/containerd" "/run/containerd"
	mount --bind "${XDG_RUNTIME_DIR}/containerd" "/run/containerd"

	# Bind-mount /var/lib/containerd
	mkdir -p "${XDG_DATA_HOME}/containerd" "/var/lib/containerd"
	mount --bind "${XDG_DATA_HOME}/containerd" "/var/lib/containerd"

	# Bind-mount /var/lib/cni
	mkdir -p "${XDG_DATA_HOME}/cni" "/var/lib/cni"
	mount --bind "${XDG_DATA_HOME}/cni" "/var/lib/cni"

	# Bind-mount /etc/containerd
	mkdir -p "${XDG_CONFIG_HOME}/containerd" "/etc/containerd"
	mount --bind "${XDG_CONFIG_HOME}/containerd" "/etc/containerd"

	if [ -n "$_CONTAINERD_ROOTLESS_SELINUX" ]; then
		# iptables requires /run in the child to be relabeled. The actual /run in the parent is unaffected.
		# https://github.com/containers/podman/blob/e6fc34b71aa9d876b1218efe90e14f8b912b0603/libpod/networking_linux.go#L396-L401
		# https://github.com/moby/moby/issues/41230
		chcon system_u:object_r:iptables_var_run_t:s0 /run
	fi

	exec containerd "$@"
fi