docs: add "Rootless mode" to Docker install guide (#16632)
* cgroups: update default filter to allow docker rootless containers * add Rootless mode to docker readme
Ilya Mashchenko committed
Dec 20, 2023 at 11:46 UTC
3ed97a3f820670c81a8eeadcdf4c967a56130351
2 files changed
+58
-1
collectors/cgroups.plugin/sys_fs_cgroup.c
+2
-1
@@ -418,6 +418,8 @@ void read_cgroup_plugin_configuration() {
418
419
" !*/init.scope " // ignore init.scope
420
" !/system.slice/run-*.scope " // ignore system.slice/run-XXXX.scope
421
+ " *user.slice/docker-*" // allow docker rootless containers
422
+ " !*user.slice*" // ignore the rest stuff in user.slice
423
" *.scope " // we need all other *.scope for sure
424
425
// ----------------------------------------------------------------
@@ -475,7 +477,6 @@ void read_cgroup_plugin_configuration() {
477
" !/system "
478
" !/systemd "
479
" !/user "
478
- " !/user.slice "
480
" !/lxc/*/* " // #2161 #2649
481
" !/lxc.monitor "
482
" !/lxc.payload/*/* "
packaging/docker/README.md
+56
@@ -426,6 +426,62 @@ volumes:
426
You can run the socket proxy in its own Docker Compose file and leave it on a private network that you can add to
427
other services that require access.
428
429
+### Rootless mode
430
+
431
+Netdata can be run successfully in a non-root environment, such as [rootless Docker](https://docs.docker.com/engine/security/rootless/).
432
+
433
+However, it should be noted that Netdata's data collection capabilities are considerably restricted in rootless Docker
434
+due to its inherent limitations. While Netdata can function in a rootless environment, it cannot access certain
435
+resources that require elevated privileges. The following components do not work:
436
+
437
+- container network interfaces monitoring (cgroup-network helper)
438
+- disk I/O and file descriptors of applications and processes (apps.plugin)
439
+- debugfs.plugin
440
+- freeipmi.plugin
441
+- perf.plugin
442
+- slabinfo.plugin
443
+- systemd-journal.plugin
444
+
445
+This method creates a [volume](https://docs.docker.com/storage/volumes/) for Netdata's configuration files
446
+_within the container_ at `/etc/netdata`.
447
+See the [configure section](#configure-agent-containers) for details. If you want to access the configuration files from
448
+your _host_ machine, see [host-editable configuration](#with-host-editable-configuration).
449
+
450
+<Tabs>
451
+<TabItem value="docker_run" label="docker run">
452
+
453
+<h3> Using the <code>docker run</code> command </h3>
454
+
455
+Run the following command in your terminal to start a new container.
456
+
457
+```bash
458
+docker run -d --name=netdata \
459
+ --hostname=$(hostname) \
460
+ -p 19999:19999 \
461
+ -v netdataconfig:/etc/netdata \
462
+ -v netdatalib:/var/lib/netdata \
463
+ -v netdatacache:/var/cache/netdata \
464
+ -v /etc/passwd:/host/etc/passwd:ro \
465
+ -v /etc/group:/host/etc/group:ro \
466
+ -v /etc/localtime:/etc/localtime:ro \
467
+ -v /proc:/host/proc:ro \
468
+ -v /sys:/host/sys:ro \
469
+ -v /etc/os-release:/host/etc/os-release:ro \
470
+ -v /run/user/$UID/docker.sock:/var/run/docker.sock:ro \
471
+ --restart unless-stopped \
472
+ --security-opt apparmor=unconfined \
473
+ netdata/netdata
474
+```
475
+
476
+</TabItem>
477
+
478
+</Tabs>
479
+
480
+> :bookmark_tabs: Note
481
+>
482
+> If you plan to Claim the node to Netdata Cloud, you can find the command with the right parameters by clicking the "
483
+> Add Nodes" button in your Space's "Nodes" view.
484
+
485
## Docker tags
486
487
See our full list of Docker images at [Docker Hub](https://hub.docker.com/r/netdata/netdata).