Pareto Security
Pareto Security
Pricing Contact
Start for Free

Existing customer? Login

Docker

Time to fix

< 10m

What

Docker rootless mode runs containers without root privileges, preventing container escapes from gaining system-wide access.

Why this matters

Traditional Docker runs with root privileges. If a container is compromised, an attacker could potentially gain full system access. Rootless Docker eliminates this risk.

Check if Docker is rootless

docker info | grep -E "(Root|rootless)"
ps aux | grep dockerd

If rootless, dockerd runs under your user, not root.

Install rootless Docker

Prerequisites (Ubuntu/Debian):

sudo apt-get install -y uidmap dbus-user-session

Install and setup:

# Disable system Docker if running
sudo systemctl disable --now docker.service docker.socket

# Install rootless Docker
curl -fsSL https://get.docker.com/rootless | sh

# Enable auto-start
systemctl --user enable docker
sudo loginctl enable-linger $(whoami)

Add to shell profile:

export PATH=/home/$USER/bin:$PATH
export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/docker.sock

Verify

systemctl --user start docker
docker run --rm hello-world
Security Impact

Even if containers are compromised, attackers cannot gain root access to your host system. This fundamentally improves your security posture.

Complete Documentation

For detailed installation instructions, troubleshooting, and configuration options, see: Docker Rootless Documentation