Welcome to nginx!

[{"_1":2,"_181":-5,"_182":-5},"loaderData",{"_3":4,"_17":18,"_25":26,"_160":161},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7,"_13":14,"_15":16},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","theme","system","contrast","normal","routes/_layout",{"_19":-5,"_20":21,"_22":21,"_23":11,"_24":21},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_27":28,"_29":-5,"_30":11,"_31":11,"_32":33,"_34":35,"_36":-5,"_37":11,"_38":39,"_89":90,"_111":112,"_149":-5,"_150":11,"_151":21,"_152":11,"_153":-5,"_154":11,"_155":-5,"_156":157,"_158":113,"_159":-7},"canonicalUrl","https://hub.docker.com/r/rootlesscontainers/usernetes/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","rootlesscontainers","reponame","usernetes","cloudBuildSource","isAutobuildsAvailable","repo",{"_40":41,"_42":43,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":55,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":69,"_70":71,"_72":11,"_73":33,"_74":75,"_80":11,"_81":82,"_86":33,"_87":88},"categories",[],"content_types",[44],"image","date_registered","2019-01-21T06:44:13.75104Z","description","Kubernetes installable under $HOME, without the root privileges","is_private","last_updated","2021-06-24T10:20:43.328324Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[56],"application/vnd.docker.container.image.v1+json","name","pull_count",908,"repository_type","star_count",2,"status",1,"status_description","active","source","collaborator_count",0,"full_description","# Usernetes: Kubernetes without the root privileges\n\nUsernetes aims to provide a reference distribution of Kubernetes that can be installed under a user's `$HOME` and does not require the root privileges.\n\n\n\n\n\n- [Included components](#included-components)\n- [Adoption](#adoption)\n- [How it works](#how-it-works)\n- [Restrictions](#restrictions)\n- [Requirements](#requirements)\n - [Distribution-specific hint](#distribution-specific-hint)\n - [Ubuntu](#ubuntu)\n - [Debian GNU/Linux](#debian-gnulinux)\n - [Arch Linux](#arch-linux)\n - [openSUSE](#opensuse)\n - [Fedora, RHEL/CentOS](#fedora-rhelcentos)\n- [Quick start](#quick-start)\n - [Download](#download)\n - [Install](#install)\n - [Use `kubectl`](#use-kubectl)\n - [Uninstall](#uninstall)\n- [Run Usernetes in Docker](#run-usernetes-in-docker)\n - [Single node](#single-node)\n - [Multi node (Docker Compose)](#multi-node-docker-compose)\n- [Advanced guide](#advanced-guide)\n - [Enabling cgroups](#enabling-cgroups)\n - [Enable cgroup v2](#enable-cgroup-v2)\n - [Enable cpu controller](#enable-cpu-controller)\n - [Run Usernetes installer](#run-usernetes-installer)\n - [Expose netns ports to the host](#expose-netns-ports-to-the-host)\n - [Routing ping packets](#routing-ping-packets)\n - [IP addresses](#ip-addresses)\n - [Install Usernetes from source](#install-usernetes-from-source)\n- [License](#license)\n\n\n\n## Included components\n\n* Installer scripts\n* Rootless Containers infrastructure ([RootlessKit](https://github.com/rootless-containers/rootlesskit), [slirp4netns](https://github.com/rootless-containers/slirp4netns), and [fuse-overlayfs](https://github.com/containers/fuse-overlayfs))\n* Master components (`etcd`, `kube-apiserver`, ...)\n* Node components (`kubelet` and `kube-proxy`)\n* CRI runtimes\n * containerd (default)\n * CRI-O\n* OCI runtime\n * crun\n* Multi-node CNI\n * Flannel (VXLAN)\n* CoreDNS\n\nCurrently, Usernetes uses our patched version of `kubelet` and `kube-proxy`. We are proposing our patches to the Kubernetes upstream. See [#42](https://github.com/rootless-containers/usernetes/issues/42) for the current status.\n\nInstaller scripts are in POC status.\n\nSee [Adoption](#adoption) for Usernetes-based Kubernetes distributions.\n\n> **Note**\n>\n> [Usernetes no longer includes Docker (Moby) binaries since February 2020.](https://github.com/rootless-containers/usernetes/pull/126)\n>\n> To install Rootless Docker, see https://get.docker.com/rootless .\n>\n> See also https://docs.docker.com/engine/security/rootless/ for the further information.\n\n## Adoption\n\nWe encourage other Kubernetes distributions to adopt Usernetes patches and tools.\n\nCurrently, the following distributions adopt Usernetes:\n* [k3s](https://github.com/k3s-io/k3s/blob/master/k3s-rootless.service)\n* [Silverkube](https://github.com/podenv/silverkube)\n\n## How it works\n\nUsernetes executes Kubernetes and CRI runtimes without the root privileges by using unprivileged [`user_namespaces(7)`](http://man7.org/linux/man-pages/man7/user_namespaces.7.html), [`mount_namespaces(7)`](http://man7.org/linux/man-pages/man7/mount_namespaces.7.html), and [`network_namespaces(7)`](http://man7.org/linux/man-pages/man7/network_namespaces.7.html).\n\nTo set up NAT across the host and the network namespace without the root privilege, Usernetes uses a usermode network stack ([slirp4netns](https://github.com/rootless-containers/slirp4netns)).\n\nNo SETUID/SETCAP binary is needed, except [`newuidmap(1)`](http://man7.org/linux/man-pages/man1/newuidmap.1.html) and [`newgidmap(1)`](http://man7.org/linux/man-pages/man1/newgidmap.1.html), which are used for setting up [`user_namespaces(7)`](http://man7.org/linux/man-pages/man7/user_namespaces.7.html) with multiple sub-UIDs and sub-GIDs.\n\n## Restrictions\n\n* Usermode networking called [slirp4netns](https://github.com/rootless-containers/slirp4netns) is used instead of kernel-mode [vEth](http://man7.org/linux/man-pages/man4/veth.4.html) pairs.\n* [fuse-overlayfs](https://github.com/containers/fuse-overlayfs) is used instead of kernel-mode overlayfs.\n* Node ports are network-namespaced\n* No support for cgroup v1. Resource limitations are ignored on cgroup v1 hosts. To enable support for cgroup (v2 only), see [Enabling cgroups](#enabling-cgroups).\n* Apparmor is unsupported\n\n## Requirements\n\n* Kernel >= 4.18.\n\n* Recent version of systemd. Known to work with systemd >= 242.\n\n* `mount.fuse3` binary. Provided by `fuse3` package on most distros.\n\n* `iptables` binary. Provided by `iptables` package on most distros.\n\n* `newuidmap` and `newgidmap` binaries. Provided by `uidmap` package on most distros.\n\n* `/etc/subuid` and `/etc/subgid` should contain more than 65536 sub-IDs. e.g. `exampleuser:231072:65536`. These files are automatically configured on most distros.\n\n```console\n$ id -u\n1001\n$ whoami\nexampleuser\n$ grep \"^$(whoami):\" /etc/subuid\nexampleuser:231072:65536\n$ grep \"^$(whoami):\" /etc/subgid\nexampleuser:231072:65536\n```\n\n### Distribution-specific hint\nRecommended host distributions are Ubuntu 21.04 and Fedora 34.\n\n#### Debian GNU/Linux\n* Add `kernel.unprivileged_userns_clone=1` to `/etc/sysctl.conf` (or `/etc/sysctl.d`) and run `sudo sysctl -p`\n\n#### Arch Linux\n* Add `kernel.unprivileged_userns_clone=1` to `/etc/sysctl.conf` (or `/etc/sysctl.d`) and run `sudo sysctl -p`\n\n#### openSUSE\n* `sudo modprobe ip_tables iptable_mangle iptable_nat iptable_filter` is required. (This is likely to be required on other distros as well)\n\n#### Fedora, RHEL/CentOS\n* Run `sudo dnf install -y iptables`.\n\n## Quick start\n\n### Download\n\nDownload the latest `usernetes-x86_64.tbz` from [Releases](https://github.com/rootless-containers/usernetes/releases).\n\n```console\n$ tar xjvf usernetes-x86_64.tbz\n$ cd usernetes\n```\n\n### Install\n\n`install.sh` installs Usernetes systemd units to `$HOME/.config/systemd/unit`.\n\nTo use containerd as the CRI runtime (default):\n```console\n$ ./install.sh --cri=containerd\n[INFO] Base dir: /home/exampleuser/gopath/src/github.com/rootless-containers/usernetes\n[INFO] Installing /home/exampleuser/.config/systemd/user/u7s.target\n[INFO] Installing /home/exampleuser/.config/systemd/user/u7s-rootlesskit.service\n[INFO] Installing /home/exampleuser/.config/systemd/user/u7s-etcd.target\n[INFO] Installing /home/exampleuser/.config/systemd/user/u7s-etcd.service\n[INFO] Installing /home/exampleuser/.config/systemd/user/u7s-master.target\n[INFO] Installing /home/exampleuser/.config/systemd/user/u7s-kube-apiserver.service\n[INFO] Installing /home/exampleuser/.config/systemd/user/u7s-kube-controller-manager.service\n[INFO] Installing /home/exampleuser/.config/systemd/user/u7s-kube-scheduler.service\n[INFO] Installing /home/exampleuser/.config/systemd/user/u7s-node.target\n[INFO] Installing /home/exampleuser/.config/systemd/user/u7s-containerd.service\n[INFO] Installing /home/exampleuser/.config/systemd/user/u7s-kubelet-containerd.service\n[INFO] Installing /home/exampleuser/.config/systemd/user/u7s-kube-proxy.service\n[INFO] Starting u7s.target\n+ systemctl --user -T enable u7s.target\nCreated symlink /home/exampleuser/.config/systemd/user/multi-user.target.wants/u7s.target → /home/exampleuser/.config/systemd/user/u7s.target.\n+ systemctl --user -T start u7s.target\nEnqueued anchor job 522 u7s.target/start.\nEnqueued auxiliary job 538 u7s-rootlesskit.service/start.\nEnqueued auxiliary job 542 u7s-kubelet-containerd.service/start.\nEnqueued auxiliary job 541 u7s-containerd.service/start.\nEnqueued auxiliary job 524 u7s-etcd.service/start.\nEnqueued auxiliary job 546 u7s-kube-controller-manager.service/start.\nEnqueued auxiliary job 523 u7s-etcd.target/start.\nEnqueued auxiliary job 543 u7s-master.target/start.\nEnqueued auxiliary job 544 u7s-kube-scheduler.service/start.\nEnqueued auxiliary job 545 u7s-kube-apiserver.service/start.\nEnqueued auxiliary job 539 u7s-node.target/start.\nEnqueued auxiliary job 540 u7s-kube-proxy.service/start.\n+ systemctl --user --no-pager status\n● localhost\n State: running\n...\n[INFO] Hint: `sudo loginctl enable-linger` to start user services automatically on the system start up.\n[INFO] Hint: To enable addons including CoreDNS, run: kubectl apply -f /home/exampleuser/gopath/src/github.com/rootless-containers/usernetes/manifests/*.yaml\n[INFO] Hint: KUBECONFIG=/home/exampleuser/.config/usernetes/master/admin-localhost.kubeconfig\n```\n\nTo enable CoreDNS:\n```console\n$ export KUBECONFIG=\"$HOME/.config/usernetes/master/admin-localhost.kubeconfig\"\n$ kubectl apply -f manifests/*.yaml\nserviceaccount/coredns created\nclusterrole.rbac.authorization.k8s.io/system:coredns created\nclusterrolebinding.rbac.authorization.k8s.io/system:coredns created\nconfigmap/coredns created\ndeployment.apps/coredns created\nservice/kube-dns created\n```\n\nTo use CRI-O:\n```console\n$ ./install.sh --cri=crio\n```\n\n### Use `kubectl`\n\n```console\n$ export KUBECONFIG=\"$HOME/.config/usernetes/master/admin-localhost.kubeconfig\"\n$ kubectl get nodes -o wide\n```\n\n### Uninstall\n\n```console\n$ ./uninstall.sh\n```\n\nTo remove data files:\n```console\n$ ./show-cleanup-command.sh\n$ eval $(./show-cleanup-command.sh)\n```\n\n## Run Usernetes in Docker\n\nAll-in-one Docker image is available as [`ghcr.io/rootless-containers/usernetes`](https://ghcr.io/rootless-containers/usernetes) on GHCR.\n\n:warning: [`rootlesscontainers/usernetes`](https://hub.docker.com/r/rootlesscontainers/usernetes) on Docker Hub is no longer updated.\nPlease use the GHCR image.\n\nTo build the image manually:\n\n```console\n$ docker build -t ghcr.io/rootless-containers/usernetes .\n```\n\nThe image is based on Fedora.\n\n### Single node\n\n```console\n$ docker run -td --name usernetes-node -p 127.0.0.1:6443:6443 --privileged ghcr.io/rootless-containers/usernetes --cri=containerd\n```\n\nWait until `docker ps` shows \"healty\" as the status of `usernetes-node` container.\n\n```console\n$ docker cp usernetes-node:/home/user/.config/usernetes/master/admin-localhost.kubeconfig docker.kubeconfig\n$ export KUBECONFIG=./docker.kubeconfig\n$ kubectl apply -f manifests/*.yaml\n$ kubectl run -it --rm --image busybox foo\n/ #\n```\n\n### Multi node (Docker Compose)\n\n```console\n$ make up\n$ export KUBECONFIG=$HOME/.config/usernetes/docker-compose.kubeconfig\n$ kubectl apply -f manifests/*.yaml\n```\n\nFlannel VXLAN `10.5.0.0/16` is configured by default.\n\n```console\n$ kubectl get nodes -o wide\nNAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME\n967e81e90e1f Ready 3m42s v1.14-usernetes 10.0.101.100 Ubuntu 18.04.1 LTS 4.15.0-43-generic docker://Unknown\nb2204f192e5c Ready 3m42s v1.14-usernetes 10.0.102.100 Ubuntu 18.04.1 LTS 4.15.0-43-generic cri-o://1.14.0-dev\nba0133c68378 Ready 3m42s v1.14-usernetes 10.0.103.100 Ubuntu 18.04.1 LTS 4.15.0-43-generic containerd://1.2.0-168-gb3807c5d\n$ kubectl run --replicas=3 --image=nginx:alpine nginx\n$ kubectl get pods -o wide\nNAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES\nnginx-6b4b85b77b-7hqrk 1/1 Running 0 3s 10.5.13.3 b2204f192e5c \nnginx-6b4b85b77b-8rknj 1/1 Running 0 3s 10.5.79.3 967e81e90e1f \nnginx-6b4b85b77b-r466s 1/1 Running 0 3s 10.5.7.3 ba0133c68378 \n$ kubectl exec -it nginx-6b4b85b77b-7hqrk -- wget -O - http://10.5.79.3\nConnecting to 10.5.79.3 (10.5.79.3:80)\n\n\n\nWelcome to nginx!\n...\n$ kubectl exec -it nginx-6b4b85b77b-7hqrk -- wget -O - http://10.5.7.3\nConnecting to 10.5.7.3 (10.5.7.3:80)\n\n\n\nWelcome to nginx!\n...\n```\n\n## Advanced guide\n\n### Enabling cgroups\n\nTo enable cgroups (resource limits), the host needs to be running with cgroup v2.\n\nIf `/sys/fs/cgroup/cgroup.controllers` is present on your system, you are using v2, otherwise you are using v1.\n\n#### Enable cgroup v2\nTo enable cgroup v2, add `systemd.unified_cgroup_hierarchy=1` to the `GRUB_CMDLINE_LINUX` line in `/etc/default/grub` and run `sudo update-grub`.\n\nIf `grubby` command is available on your system, this step can be also accomplished with `sudo grubby --update-kernel=ALL --args=\"systemd.unified_cgroup_hierarchy=1\"`.\n\n\n#### Enable cpu controller\nTypically, only `memory` and `pids` controllers are delegated to non-root users by default.\n```console\n$ cat /sys/fs/cgroup/user.slice/user-$(id -u).slice/user@$(id -u).service/cgroup.subtree_control\nmemory pids\n```\n\n\nTo allow delegation of all controllers, you need to change the systemd configuration as follows:\n\n```console\n# mkdir -p /etc/systemd/system/user@.service.d\n# cat > /etc/systemd/system/user@.service.d/delegate.conf << EOF\n[Service]\nDelegate=yes\nEOF\n# systemctl daemon-reload\n```\n\nYou have to re-login or reboot the host after changing the systemd configuration. Rebooting is recommended.\n\n#### Run Usernetes installer\n\nThe installer script (`install.sh`) does not need a special flag to enable rootless cgroup.\n\nJust run `install.sh`:\n```console\n$ ./install.sh\n```\n\nBoth containerd (`--cri=containerd`) and CRI-O (`--cri=crio`) are supported.\n\n### Expose netns ports to the host\n\nAs Usernetes runs in a network namespace (with [slirp4netns](https://github.com/rootless-containers/slirp4netns)),\nyou can't expose container ports to the host by just running `kubectl expose --type=NodePort`.\n\nIn addition, you need to expose Usernetes netns ports to the host:\n\n```console\n$ ./rootlessctl.sh add-ports 0.0.0.0:30080:30080/tcp\n```\n\nYou can also manually expose Usernetes netns ports manually with `socat`:\n\n```console\n$ pid=$(cat $XDG_RUNTIME_DIR/usernetes/rootlesskit/child_pid)\n$ socat -t -- TCP-LISTEN:30080,reuseaddr,fork EXEC:\"nsenter -U -n -t $pid socat -t -- STDIN TCP4\\:127.0.0.1\\:30080\"\n```\n\n### Routing ping packets\n\nTo route ping packets, you may need to set up `net.ipv4.ping_group_range` properly as the root.\n\n```console\n$ sudo sh -c \"echo 0 2147483647 > /proc/sys/net/ipv4/ping_group_range\"\n```\n\n### IP addresses\n\n* 10.0.0.0/24: The CIDR for the Kubernetes ClusterIP services\n * 10.0.0.1: The kube-apiserver ClusterIP\n * 10.0.0.53: The CoreDNS ClusterIP\n\n* 10.0.42.0/24: The default CIDR for the RootlessKit network namespace. Can be overridden with `install.sh --cidr=`. \n * 10.0.42.2: The slirp4netns gateway\n * 10.0.42.3: The slirp4netns DNS\n * 10.0.42.100: The slirp4netns TAP device\n\n* 10.0.100.0/24: The CIDR used instead of 10.0.42.0/24 in Docker Compose master\n* 10.0.101.0/24: The CIDR used instead of 10.0.42.0/24 in Docker Compose containerd node\n* 10.0.102.0/24: The CIDR used instead of 10.0.42.0/24 in Docker Compose CRI-O node\n\n* 10.5.0.0/16: The CIDR for Flannel\n\n* 10.88.0.0/16: The CIDR for single-node CNI\n\n### Install Usernetes from source\n\nDocker 17.05+ is required for building Usernetes from the source.\nDocker 18.09+ with `DOCKER_BUILDKIT=1` is recommended.\n\n```console\n$ make\n```\n\nBinaries are generated under `./bin` directory.\n\n## License\n\nUsernetes is licensed under the terms of [Apache License Version 2.0](LICENSE).\n\nThe binary releases of Usernetes contain files that are licensed under the terms of different licenses:\n\n* `bin/crun`: [GNU GENERAL PUBLIC LICENSE Version 2](docs/binary-release-license/LICENSE-crun), see https://github.com/containers/crun\n* `bin/fuse-overlayfs`: [GNU GENERAL PUBLIC LICENSE Version 3](docs/binary-release-license/LICENSE-fuse-overlayfs), see https://github.com/containers/fuse-overlayfs\n* `bin/slirp4netns`: [GNU GENERAL PUBLIC LICENSE Version 2](docs/binary-release-license/LICENSE-slirp4netns), see https://github.com/rootless-containers/slirp4netns\n* `bin/{cfssl,cfssljson}`: [2-Clause BSD License](docs/binary-release-license/LICENSE-cfssl), see https://github.com/cloudflare/cfssl\n","has_starred","hub_user","immutable_tags_settings",{"_76":11,"_77":78},"enabled","rules",[79],".*","is_automated","permissions",{"_83":21,"_84":11,"_85":11},"read","write","admin","user","storage_size",45585175467,"orgData",{"_91":92,"_93":94,"_95":96,"_97":33,"_98":99,"_100":99,"_101":99,"_102":103,"_104":105,"_106":107,"_108":99,"_109":99,"_110":21},"id","d7784127a6d84c07b2ca03e781191361","uuid","d7784127-a6d8-4c07-b2ca-03e781191361","type","organization","orgname","full_name","","location","company","profile_url","https://github.com/rootless-containers","date_joined","2018-08-01T08:28:50.874431Z","gravatar_url","https://www.gravatar.com/avatar/80974c4d0b72d3db817c56f1ae35f271?s=80&r=g&d=mm","gravatar_email","badge","is_active","recentTags",[113],{"_114":44,"_115":116,"_117":118,"_91":119,"_120":121,"_50":138,"_139":116,"_140":33,"_141":56,"_57":142,"_143":144,"_145":129,"_146":138,"_147":66,"_148":21},"content_type","creator",3669120,"full_size",514522975,44637580,"images",[122],{"_123":124,"_125":126,"_127":99,"_128":129,"_130":131,"_132":133,"_134":99,"_135":-5,"_136":118,"_63":66,"_137":-5},"architecture","amd64","digest","sha256:3182e4b3e12436b11827f7252a5b572be184bf1047ddcc2fa8844ff471399bc0","features","last_pulled","2026-10-09T08:18:54.715037117Z","last_pushed","2021-06-24T10:20:43Z","os","linux","os_features","os_version","size","variant","2021-06-24T10:20:42.915558Z","last_updater","last_updater_username","media_type","latest","repository",6576396,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"selectedTag","attestationsUrl","routes/_layout.r.$namespace.$reponame.tags",{"_38":162,"_169":170,"_156":179,"_180":11},{"_40":163,"_42":164,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":165,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":69,"_70":71,"_72":11,"_73":33,"_74":166,"_80":11,"_81":168,"_86":33,"_87":88},[],[44],[56],{"_76":11,"_77":167},[79],{"_83":21,"_84":11,"_85":11},"tags",{"_171":64,"_172":-5,"_173":-5,"_174":175},"count","next","previous","results",[176],{"_114":44,"_115":116,"_117":118,"_91":119,"_120":177,"_50":138,"_139":116,"_140":33,"_141":56,"_57":142,"_143":144,"_145":129,"_146":138,"_147":66,"_148":21},[178],{"_123":124,"_125":126,"_127":99,"_128":129,"_130":131,"_132":133,"_134":99,"_135":-5,"_136":118,"_63":66,"_137":-5},[],"canDeleteTags","actionData","errors"]

rootlesscontainers/usernetes

Tags for rootlesscontainers/usernetes