Arch Linux User Repository

I'm curious why only Arch and Debian need to set kernel.unprivileged_userns_clone=1, but other distros don't.

I can still run this fine though:

$ cat /proc/sys/kernel/unprivileged_userns_clone
1

Did you actually set this variable (or reboot after installing this package)?

@whynothugo: Ah, sorry, I used my own PKGBUILD.

Here is an error:

==> ERROR: Integrity checks are missing for: source

You might want to add aarch64 and either do a SKIP for the first line or add this:

b67a3350da99edd549b2aa0eefd60ba7eade0072845b64d5ff0766cf64d82f34

@whynothugo: I could build an aarch64 package without issues, I also could install it and start docker-rootless.sh

Although, without the kernel/unprivileged_userns_clone feature I cannot build my planned docker image... this is a docker issue though.

Something else I noticed:

Couldn't write '1' to 'kernel/unprivileged_userns_clone', ignoring: No such file or directory

This feature is contradicted and is being said to be a heavy security issue: https://github.com/archlinux/linux/commit/479ca137ea2b368c8c8e84d5ce7c4084f5653a0d#diff-02e6057517474f1cfa234bb77eb4f675a81fb1c7136a000ae8b58b63e11a546dR1179

It is also absent in the current kernel: https://github.com/archlinux/linux/blob/master/init/Kconfig#L1183

You might want to add some warning and some check, in case the kernel doesn't support it (mine does not).

Added aarch64 to both this and docker-rootless-extras.

I don't have an environment on which to test it though. Have you managed to build an aarch64 ISO?

Please add support for aarch64:

arch=('x86_64')
-> arch=('x86_64' 'aarch64')

    "https://download.docker.com/linux/static/stable/x86_64/docker-rootless-extras-$pkgver.tgz"
->  "https://download.docker.com/linux/static/stable/$arch/docker-rootless-extras-$pkgver.tgz"

sha256sums=('ac4d55e87efa1eec306a91f655d8ae00339be5f631b8b41c10d5c588a3cf0473'
-> sha256sums=('SKIP'

Thanks, abcalphabet. The diff works fine for me as well.

I'm not entirely certain where to correctly submit this, but the following changes to the package have enabled me to work with docker 20.10.6-1 normally:

diff --git a/.SRCINFO b/.SRCINFO
index 736ac51..9d20c26 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -6,18 +6,18 @@ pkgbase = docker-rootless-extras-bin
        install = docker-rootless-extras-bin.install
        arch = x86_64
        license = Apache
-       depends = docker<1:20.10.6
+       depends = docker
        optdepends = fuse-overlayfs: overlayfs support
        optdepends = slirp4netns: faster network stack
        provides = docker-rootless
        provides = docker-rootless-extras
        conflicts = docker-rootless
        conflicts = docker-rootless-extras
-       source = https://download.docker.com/linux/static/stable/x86_64/docker-rootless-extras-20.10.5.tgz
+       source = https://download.docker.com/linux/static/stable/x86_64/docker-rootless-extras-20.10.6.tgz
        source = docker.service
        source = docker.socket
        source = 99-docker-rootless.conf
-       sha256sums = c7265d1c376dcfc182714235fc3e8ea5e2f3f540af94450fa0469cac97b3dd55
+       sha256sums = ac4d55e87efa1eec306a91f655d8ae00339be5f631b8b41c10d5c588a3cf0473
        sha256sums = 7c31c7f7755776bf9571e551ff4006035562e4394d88166809dd71b2ba847fc5
        sha256sums = d8695293e5d4a814763f13e1d36ed37273040666b4b91363d6c33171df8934c7
        sha256sums = d0d790d4c3d887b10b2b155b83a58a44980b9fa638f8c0f1faec0739dc0ef473
diff --git a/PKGBUILD b/PKGBUILD
index 6ef4171..561578b 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -3,13 +3,13 @@
 # Contributors: koba1t <kobdotsh at gmail dot com>

 pkgname=docker-rootless-extras-bin
-pkgver=20.10.5
+pkgver=20.10.6
 pkgrel=1
 pkgdesc="Extras to run docker as non-root."
 arch=('x86_64')
 url="https://docs.docker.com/engine/security/rootless/"
 license=('Apache')
-depends=('docker<1:20.10.6')
+depends=('docker')
 optdepends=('fuse-overlayfs: overlayfs support'
             'slirp4netns: faster network stack')
 provides=('docker-rootless' 'docker-rootless-extras')
@@ -22,7 +22,7 @@ source=(
        "99-docker-rootless.conf"
 )

-sha256sums=('c7265d1c376dcfc182714235fc3e8ea5e2f3f540af94450fa0469cac97b3dd55'
+sha256sums=('ac4d55e87efa1eec306a91f655d8ae00339be5f631b8b41c10d5c588a3cf0473'
             '7c31c7f7755776bf9571e551ff4006035562e4394d88166809dd71b2ba847fc5'
             'd8695293e5d4a814763f13e1d36ed37273040666b4b91363d6c33171df8934c7'
             'd0d790d4c3d887b10b2b155b83a58a44980b9fa638f8c0f1faec0739dc0ef473')

Docker 20.10.6 DOES NOT work with rootless. I've reported the issue upstream, and have pinned the required version in the meantime.

Make sure you update this package before you upgrade docker itself.

Opened https://github.com/moby/moby/issues/42078 with all my findings.