aws / aws/containers-roadmap

[ECS] [request]: Support docker rootless

Open
#1,059 4 comments 56 reactions 0 assignees View on GitHub
ECS Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
ECS agent support for Rootless Docker Daemon https://docs.docker.com/engine/security/rootless/

**Which service(s) is this request for?**
ECS

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
I want to run ECS service container daemon should be run by non-root user. By using USER instruction I am able to run the process inside the container by non-root user but it's recommended to run container also with non privileged user.

When I run dockerd with rootless experiment feature and start the container on that host manually, it runs as a rootless. Same result I want to achieve when we deploy ECS service. But as soon as I start ecs agent and deploy my ecs service, it start the container as a root user. It's because when ecs agent start, it check if dockerd is running or not ( via Docker Host file ), if not find default socket file, it start dockerd. In my case, when I start ecs agent, it start new dockerd on my host as rootless dockerd created socket file on different location. So I tried to define DOCKER_HOST parameter so that when ECS agent start, it find that dockerd is already running and do not start new dockerd with root. But when I define that Docker socket path, amazon-ecs-init failed to start with permission error because the the Socket /home//.docker/run/docker.sock have ownership on that non-root user.

`amazon-ecs-init: #033[0m2020-09-02T19:46:59Z #033[46m[ERROR]#033[49m could not start Agent: API error (500): {"message":"OCI runtime create failed: container_linux.go:349: starting container process caused \"process_linux.go:449: container init caused \\\"rootfs_linux.go:58: mounting \\\\\\\"/proc\\\\\\\" to rootfs \\\\\\\"/home/cvt_ecs_java/.local/share/docker/vfs/dir/xxxxxxxxxxxxx\\\\\\\" at `\\\\\\\"/home/cvt_ecs_java/.local/share/docker/vfs/dir/xxxxxxxxxxxxxx/host/proc\\\\\\\"` caused \\\\\\\"operation not permitted\\\\\\\"\\\"\": unknown"}`

Contributor guide

Open the contributing guide

Research direction

Start by investigating how amazon-ecs-init uses DOCKER_HOST and discovers the Docker socket when starting the ECS agent. Reproduce the permission failure with a rootless Docker socket and compare it with the documented rootless Docker behavior. Done means ECS can deploy services through the existing rootless daemon without starting a root-owned daemon.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker
Domain
cloud
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.