Install Docker binary on a server without root acc

Question

I have a server by a provider without any root access. It is not possible to write scripts in /etc/ or /var/lib/docker. Docker is not installed. My idea is to install and run docker binary in directory. I will install docker with a shell script. The script should be able to be started from any directory without root access.

When the script starts ./docker/dockerd --data-root=docker/var/lib/docker I get this error message.

WARN[2018-11-17T18:26:19.492488618+01:00] Error while setting daemon root propagation, this is not generally critical but may cause some functionality to not work or fallback to less desirable behavior dir=docker/var/lib/docker error="error getting daemon root's parent mount: open /proc/self/mountinfo: permission denied" Error starting daemon: open /var/run/docker.pid: permission denied

dockerd has so many parameter. Here for the pidfile: -p | **--pidfile*[=/var/run/docker.pid]

http://manpages.ubuntu.com/manpages/cosmic/man8/dockerd.8.html

Thank you for the help

#!/bin/bash

DOCKER_RELEASE='docker-18.06.1-ce.tgz'

wget https://download.docker.com/linux/static/stable/x86_64/$DOCKER_RELEASE
tar xzvf $DOCKER_RELEASE
rm $DOCKER_RELEASE

./docker/dockerd --data-root=docker/var/lib/docker

Answer 1

As announced today (Feb. 4th, 2019) by Akihiro Suda:

Finally, it is now possible to run upstream dockerd as an unprivileged user!

See moby/moby PR 38050:

Allow running dockerd in an unprivileged user namespace (rootless mode).
Close #37375 "Proposal: allow running dockerd as an unprivileged user (aka rootless mode)", opened in June 2018

No SETUID/SETCAP binary is required, except newuidmap and newgidmap.

How I did it:

By using user_namespaces(7), mount_namespaces(7), network_namespaces(7), and slirp4netns.

Warning, there are restrictions:

Restrictions:

• Only vfs graphdriver is supported.
  However, on Ubuntu and a few distros, overlay2 and overlay are also supported.
  Starting with Linux 4.18, we will be also able to implement FUSE snapshotters.

(See Graphdriver plugins, where Docker graph driver plugins enable admins to use an external/out-of-process graph driver for use with Docker engine.
This is an alternative to using the built-in storage drivers, such as aufs/overlay/devicemapper/btrfs.)

• Cgroups (including docker top) and AppArmor are disabled at the moment.
  In future, Cgroups will be optionally available when delegation permission is configured on the host.
• Checkpoint is not supported at the moment.
• Running rootless dockerd in rootless/rootful dockerd is also possible, but not fully tested.

The documentation is now in docs/rootless.md:

Note the following requirements:

• newuidmap and newgidmap need to be installed on the host.
  These commands are provided by the uidmap package on most distros.

• /etc/subuid and /etc/subgid should contain >= 65536 sub-IDs.
  e.g. penguin:231072:65536.

That is:

$ id -u
1001
$ whoami
penguin
$ grep ^$(whoami): /etc/subuid
penguin:231072:65536
$ grep ^$(whoami): /etc/subgid
penguin:231072:65536

Either slirp4netns (v0.3+) or VPNKit needs to be installed.
slirp4netns is preferred for the best performance.

You will have to modify your script:

You need to run dockerd-rootless.sh instead of dockerd.

$ dockerd-rootless.sh --experimental"