rootlesskit

Yes, from the README: > Bocker runs as root and among other things needs to make changes to your network interfaces, routing table, and firewall rules. I can make no guarantees that it won't trash your system. Linux makes it quite hard to run "containers" as an unprivileged user. Not impossible! https://github.com/rootless-containers/rootlesskit is one approach and demonstrates much of the difficulty involved. Networking is perhaps the most problematic. Your choices are either setuid binaries (so basically less-root as opposed to root-less) or usermode networking. slirp4netns is the state of the art here as far as I know, but not without security and performance tradeoffs.

Warning, Rootless Docker doesn't support the ability to see the users source IP yet with IPv6. * https://github.com/rootless-containers/rootlesskit/issues/25... * https://github.com/rootless-containers/slirp4netns/issues/25... This has repercussions if you need to be able to see the user's IP for throttling, banning, etc.

There may be some overhead with networking if your application uses a very large amount of bandwidth. See: https://github.com/rootless-containers/rootlesskit/tree/v0.1... Otherwise for general dockerized applications, you won't notice any difference. You may find some quirks, but these can all be worked around easily as described on the rootless docker page. We run it in production with no issues so far.

This sounds very similar to my slirpnetstack, which is using gvisor netstack to do, which I call translating L3 (packets) into L7 (userspace syscalls like connect()): https://github.com/majek/slirpnetstack/ (btw, gvisor netstack, while not without problems, is likely to be faster than libslirp, see benchmarks https://github.com/rootless-containers/rootlesskit/pull/101#... )

Thank you for detailed answer and interesting links! Could you please explain/point me to some information/source, why docker can't use -net=host namespace if userns is enabled, while on the other hand rootlesskit[1] which uses userns by default, dont have problem with using host netns (--net=host) ? [1] https://github.com/rootless-containers/rootlesskit

In a shell you can do this with `unshare -prf` which will create an unprivileged user namespace (mapping only yourself -- if you want more complicated stuff you'll need to use rootlesskit[1] or a shell script). Note that most programs really don't like being in an unprivileged user namespace (something the rootless-containers project has been working on fixing so you can have completely unprivileged containers in every sense of the word "just work"). [1]: https://github.com/rootless-containers/rootlesskit