无法在无根模式下部署Docker Swarm堆栈，mkdir/var/lib/Docker:权限被拒绝

Question

我已经在Ubuntu 20.04和Debian 11下以无根模式设置了Docker(在我的情况下，使用Ansible和这个角色(。我想通过Docker Swarm在节点上部署一个简单的Docker堆栈。没有其他主机参与，只有来自同一台机器的一个Swarm节点作为管理器。

我可以用Docker和Docker Compose运行这个项目，也可以在无根模式下运行。无根设置的所有变化是DOCKER_HOST在.bashrc:中被覆盖

export XDG_RUNTIME_DIR="/run/user/1000"
export DOCKER_HOST="unix:///run/user/1000/docker.sock"

然而，当我部署堆栈时，没有一个服务可以启动(以下是状态摘录(：

$ docker stack deploy -c docker-stack.yml demo-stack
$ docker stack ps demo-stack --no-trunc
jig6zyewkem2g225509x91nt5   demo-stack_db.1                  registry.example.com/db:v1.20.2      bullseye   Shutdown        Rejected 15 seconds ago   "mkdir /var/lib/docker: permission denied"   
ox6x5w7du9o5ew2v70g5mfg9e   demo-stack_redis.1               registry.example.com/redis:v1.20.2   bullseye   Shutdown        Rejected 15 seconds ago   "mkdir /var/lib/docker: permission denied"   
ipme447wrrsjc8jw6cpfak4hq   demo-stack_web.1                 registry.example.com/web:v1.20.2     bullseye   Shutdown        Rejected 14 seconds ago   "mkdir /var/lib/docker: permission denied"   

mkdir /var/lib/docker: permission denied的服务全部出错。我想它试图像系统使用rootful Docker一样启动它们，但这是一个无根安装。

我想问题是：如何让Swarm节点(同一台机器(使用正确的Docker无根配置来启动服务？这将包括使用正确的DOCKER_HOST配置。

我甚至不确定这是否应该奏效。我听说不支持覆盖网络，但我只在一台机器上，所以我真的不需要这个。我确实需要Swarm来实现其可用的秘密(与Docker Compose的mock实现相比(。

请注意，我有相同的设置，Docker在(正常(rootful模式下运行，在那里，所有服务都可以启动。因此，这不是Docker堆栈文件本身的问题。

docker info:的更多细节

Client:
Context:    default
Debug Mode: false
Server:
Containers: 0
Running: 0
Paused: 0
Stopped: 0
Images: 12
Server Version: 20.10.13
Storage Driver: fuse-overlayfs
Logging Driver: json-file
Cgroup Driver: systemd
Cgroup Version: 2
Plugins:
Volume: local
Network: bridge host ipvlan macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
Swarm: active
NodeID: hpzsmez48acse9yo1frnx37fo
Is Manager: true
ClusterID: zkv7wsoun193kyvbxe1k3hdph
Managers: 1
Nodes: 1
Default Address Pool: 10.0.0.0/8  
SubnetSize: 24
Data Path Port: 4789
Orchestration:
Task History Retention Limit: 5
Raft:
Snapshot Interval: 10000
Number of Old Snapshots to Retain: 0
Heartbeat Tick: 1
Election Tick: 10
Dispatcher:
Heartbeat Period: 5 seconds
CA Configuration:
Expiry Duration: 3 months
Force Rotate: 0
Autolock Managers: false
Root Rotation In Progress: false
Node Address: 127.0.0.1
Manager Addresses:
127.0.0.1:2377
Runtimes: io.containerd.runc.v2 io.containerd.runtime.v1.linux runc
Default Runtime: runc
Init Binary: docker-init
containerd version: 2a1d4dbdb2a1030dc5b01e96fb110a9d9f150ecc
runc version: v1.0.3-0-gf46b6ba2
init version: de40ad0
Security Options:
seccomp
Profile: default
rootless
cgroupns
Kernel Version: 5.10.0-13-amd64
Operating System: Debian GNU/Linux 11 (bullseye)
OSType: linux
Architecture: x86_64
CPUs: 2
Total Memory: 1.936GiB
Name: bullseye
ID: 3R5P:2UV6:FIP4:UIJV:TDNQ:35DT:DEDI:SMGN:FDUY:JSWO:FRU6:O2HF
Docker Root Dir: /home/vagrant/.local/share/docker
Debug Mode: false
Registry: https://index.docker.io/v1/
Labels:
Experimental: false
Insecure Registries:
127.0.0.0/8
Live Restore Enabled: false
Product License: Community Engine
WARNING: No cpu cfs quota support
WARNING: No cpu cfs period support
WARNING: No cpu shares support
WARNING: No cpuset support
WARNING: No io.weight support
WARNING: No io.weight (per device) support
WARNING: No io.max (rbps) support
WARNING: No io.max (wbps) support
WARNING: No io.max (riops) support
WARNING: No io.max (wiops) support
WARNING: bridge-nf-call-iptables is disabled
WARNING: bridge-nf-call-ip6tables is disabled

Answer 1

解决方案很简单：Docker Rootless不适用于Docker Swarm。你可以两者都有，但不能两者都有。