‫Then the last one here is
‫Docker Rootless, which is a relatively new feature in the
‫last year that allows you to run the Docker daemon,
‫the Docker Engine, itself without root.
‫This doesn't work in every case.
‫The big gotcha here is that it doesn't
‫allow custom networking. So, you can't create all these
‫fancy bridge networks without having root.
‫In Linux, you need root to mess around with networking
‫essentially.
‫As long as you don't need that, if you can get away, maybe
‫this is something you do in CI, and you just need the CI
‫worker user. Maybe it's called Jenkins.
‫You have a Jenkins user and you need it to
‫run certain things. Then, you
‫can set up that CI to start the Docker daemon inside
‫a user's home directory, and then run all of its stuff
‫there. Then, it can stop Docker and, you know, exit
‫the process, and you never needed root on that machine.
‫I don't see a lot of potential for this in production,
‫but it is possible.
‫If you don't need any of
‫the networking capabilities of Docker, or you found another
‫way, essentially, you can run other commands that create
‫these networks manually, and you don't depend on Docker for
‫that. So, if you can deal with that stuff, then there might
‫be a way for you to have no root at
‫all even with the Docker daemon.
‫This is still running as
‫a systemd process, right?
‫This still is running in the background.
‫It's not running in the foreground.
‫Docker's got a nice script.
‫It's here at get.docker.com/rootless so
‫you can essentially just run that script, and if your
‫system is compatible, it will essentially run Docker as
‫that user. It'll download it, configure it and
‫then you can watch a DockerCon session on it.
‫In fact, on this channel earlier this summer, I
‫had other Docker Captains on giving demos about how
‫Rootless works. Also check that out on this
‫channel. That's my
‫top 10. Anything after that starts
‫to get into paid products, or really application
‫specific tools that aren't necessary in the broad sense of
‫everybody's security.
‫I would go down this checklist as
‫you implement your tooling. This is really production
‫specific, right.
‫This isn't a lot of stuff that you'll be running locally
‫for development. This is about production servers.