rootless-containers/rootlesskit
Rootlesskit
RootlessKit is a tool for running container workloads and isolated process trees securely as a standard non-privileged user without holding root access on the host. It creates unprivileged user and mount namespaces to simulate fake root execution environments, allowing users to execute container workloads and manage resource groups safely.
The project provides capabilities for rootless port forwarding and unprivileged network namespace isolation, routing container network traffic through user-mode packet translation without requiring privileged kernel setup. It includes multiple backend network drivers for handling packet translation, TCP port forwarding, IPv6 routing, and virtual socket TAP interfaces. Additionally, it features virtualized file storage mechanisms that isolate modifications using temporary overlay layers and copy-up directories to protect host directories, along with dynamic port mapping utilities and runtime state tracking through Unix sockets and lock files.
Features
- Network Namespace Isolation - Spins up isolated network environments with userspace NAT drivers to manage container connectivity safely.
- Rootless Container Runtimes - Runs container workloads and isolated process trees securely without host root privileges.
- Namespace and Process Utilities - Provides low-level utilities for interacting with Linux kernel namespaces and process state.
- Container Port Mappings - Exposes internal container services to external host networks.
- Network Namespace Virtualization - Creates isolated TCP/IP stacks using kernel network namespaces.
- Network Namespace Detachments - Isolates network namespaces into state directories while executing child commands in the host network context.
- Container Port Mapping - Maps internal container ports to the host to expose internal services to external networks.
- User-Space Stack Routing - Routes network traffic through user-space implementations bypassing the host kernel network stack.
- Port Forwarding - Maps local network ports to remote destinations to redirect TCP and UDP traffic.
- Process Namespace Isolation - Executes child processes inside dedicated namespaces to contain process trees and terminate internal tasks upon exit.
- Root Simulation Environments - Creates user and mount namespaces so unprivileged users can run commands with simulated root privileges.
- Userspace Network Stacks - Processes network packets entirely within a sandbox to provide connectivity without kernel privileges.
- Container Isolation - Spawns unprivileged user and mount namespaces so users can execute container workloads safely without root privileges.
- Network Namespace Sharing - Shares the host network namespace directly without isolation for zero performance overhead.
- IPv6 Address Support - Activates IPv6 support on supported network drivers to handle modern network addressing requirements.
- Network Port Configuration - Maps ports from an isolated network namespace to the host network namespace using configurable backend drivers.
- Virtual Socket Tunnels - Routes isolated network traffic through virtual socket TAP interfaces for seamless container connectivity.
- Pasta Network Drivers - Leverages host-level packet translation for high-performance TCP port forwarding and native source IP retention via pasta.
- Slirp Network Backends - Isolates the network namespace using user-mode packet translation through Slirp for flexible routing and packet capture support.
- VPNKit Network Stacks - Isolates the network namespace through a cross-platform user-mode network stack supporting TCP and UDP traffic via VPNKit.
- Filesystem Mounting - Attaches a filesystem to a specific directory in the system hierarchy to make contents accessible.
- Mount Propagation Control - Controls how mount events are shared between host and container root environments.
- Kernel Networking - Establishes low-overhead kernel-level network address translation using unprivileged SUID helpers.
- Copy-on-Write File Copies - Creates file copies that share storage with the original until modified.
- In-Memory Overlay Layers - Isolates modifications from original data using writable overlays over read-only base filesystems.
- Control-Group-Based Resource Management - Executes child processes within isolated resource control namespaces and automatically migrates active tasks into dedicated sub-groups.
- Privileged Port Bindings - Allows unprivileged users to expose ports below 1024 by configuring system kernel settings or granting network capabilities.
- User Namespace Mappings - Translates user and group identities between host and container environments.
- User ID Mapping Configurations - Configures UID and GID namespace remapping with automatic range detection and per-container isolation.
