Rootless Docker, and the four things that stop working

19.03 made rootless mode usable, and it is worth knowing what it costs before installing it on a machine that matters.

$ dockerd-rootless-setuptool.sh install
$ export DOCKER_HOST=unix:///run/user/1000/docker.sock

# what stops working:
#   binding ports below 1024        (setcap, or a proxy in front)
#   --net=host                       (a separate network namespace)
#   cgroup resource limits           (needs cgroup v2 + systemd)
#   overlayfs on some kernels        (falls back to fuse-overlayfs, slower)

The security gain is real and specific: a container escape lands you as an unprivileged user rather than as root on the host. For a CI runner that builds untrusted branches that is a meaningful difference. For a single-purpose production host where the only thing running is your own application, the port and cgroup limitations usually outweigh it in 2019 — the honest position is that this is early and worth trialling on build machines first.