What is Docker Rootless mode and why is it needed to improve security?

By default, the Docker daemon and all containers running within it are managed on behalf of the privileged root user on the host machine. This creates serious security risks, as a potential attacker escaping a container gains full control over the entire operating system of the server. Rootless mode was created to eliminate this vulnerability.

Rootless mode allows both the Docker daemon and the containers themselves to run as a regular unprivileged user without root rights. This is achieved using Linux kernel namespaces, which isolate processes and resources. Even if the application inside the container is compromised, the attacker will not have administrative access to the host.

Transitioning to this mode requires performing certain preliminary system settings. The administrator needs to configure user ID sub-migration and ensure that the kernel supports the required features. After installing the configuration utility, the daemon runs as a user service of the init system.

It is worth noting some limitations that may be encountered when using Rootless mode. For example, containers cannot bind to standard privileged network ports below one thousand without additional configuration. There may also be specific behaviors when working with certain types of network bridges and data storage.

Nevertheless, for production environments with elevated data security requirements, using Docker in Rootless mode is an excellent practice. This significantly reduces potential damage from possible cyberattacks and zero-day vulnerabilities in software.