# Docker Rootless Permission Errort

**URL:** <https://forums.docker.com/t/docker-rootless-permission-errort/141572>\
**Category:** General\
**Tags:** docker\
**Created:** [May 21, 2024, 6:22pm UTC](https://forums.docker.com/t/docker-rootless-permission-errort/141572 "2024-05-21T18:22:39Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![tomfrye](https://avatars.discourse-cdn.com/v4/letter/t/9f8e36/32.png) [@tomfrye](https://forums.docker.com/u/tomfrye)\
**Post date:** [May 21, 2024, 6:22pm UTC](https://forums.docker.com/t/docker-rootless-permission-errort/141572/1 "2024-05-21T18:22:39Z")

</div>

General system information:  
Air-Gapped network  
RHEL 8.9 patched up until May 2024  
System is AD Joined via winbind  
/home is on a NFS volume  
Docker-ce version 3.26.0.0.1 installed via local docker repo setup with all packages from [https://download.docker.com/linux/centos/8/x86\_64/stable/Packages/](https://download.docker.com/linux/centos/8/x86_64/stable/Packages/)

Modified the following:

```auto
/etc/sysctl.d/99-sysctl.conf
user.max_user_namespace=0 to 1 or 1024 or 28633

```

Modified /etc/subgid and /etc/subuid with the following:

```auto
user01:165536:65536
user02:231072:65536

```

* * *

Setting up Docker Rootless for users, but fails to open.

As normal user ran the following;

```auto
$ cd /usr/bin
$ dockerd-rootless-setup-sh install

```

Installation runs fine without failure

```auto
$ systemctl --user start docker
$ systemctl --user status docker

```

Service running without issue, all good here.

```auto
$ docker info
$ docker ps

```

All good here as well, no issues

* * *

```auto
$ docker image load -i ub8-minimal-8.9.tar
932e25b7e78c: Loading layer [==================================================>] 93.75MB/93.75MB
open /root/.bash_logout: permission denied

```

This error occurs on multiple files.

* * *

Possibly a namespace issue, but i’ve followed the docker guides for installation and rootless setup.  
Any help is appreciated.

---

<div class="post-metadata">

**Author:** ![tomfrye](https://avatars.discourse-cdn.com/v4/letter/t/9f8e36/32.png) [@tomfrye](https://forums.docker.com/u/tomfrye)\
**Post date:** [June 11, 2024, 1:32pm UTC](https://forums.docker.com/t/docker-rootless-permission-errort/141572/2 "2024-06-11T13:32:01Z")

</div>

Is there anyone in the community that can assist with this?  
Docker starts/runs fine, but is producing the above mentioned error.  
Pretty sure i’m close, would just need a little guidance on the docker output.  
Unfortunately, Redhat does not support docker-ce on rhel 8.x, therefore support from them is not available.  
Redhat only supports Podman.

---

<div class="post-metadata">

**Author:** ![rimelek](https://sea3.discourse-cdn.com/docker/user_avatar/forums.docker.com/rimelek/32/41602_2.png) [@rimelek](https://forums.docker.com/u/rimelek)\
**Post date:** [June 11, 2024, 4:01pm UTC](https://forums.docker.com/t/docker-rootless-permission-errort/141572/3 "2024-06-11T16:01:36Z")

</div>

> [@tomfrye](#):
>
> Possibly a namespace issue, but i’ve followed the docker guides for installation

You mean this one?

> **[Install Docker Engine on RHEL](https://docs.docker.com/engine/install/rhel/)**
>
> Learn how to install Docker Engine on RHEL. These instructions cover the different installation methods, how to uninstall, and next steps.

This is the official guide, but it says x86\_64 (amd64) and aarch64 support on RHEL is experimental. I don’t think your issue would be because of the architecture, but could be.

> [@tomfrye](#):
>
> `open /root/.bash_logout: permission denied`

And it happens when you load the image from a tar file? How did you create it?

> [@tomfrye](#):
>
> Docker-ce version 3.26.0.0.1 installed

That 3 at the beginning must be part of the package version, not Docker version. Docker CE 26.0.0 had some bugs. If newer versiona are available, I would try to install the latest which is 26.1.4

> [@tomfrye](#):
>
> `$ docker info`

Please, share the output. Remove secrets like IP addresses or usernames if necessary before sharing.

Until that, here is my guess:

When you load an image, Docker has to extract the tar and move the files to the docker data root. Since you ran the command as a non-root user, if the files in the tar are owned by root, it is possible that Docker has no permision move the files, although that would not be an “open” operation. I never tried to load an image as a non root user, but I will test it soon.

**EDIT:** I tried, it worked for me.

> [@tomfrye](#):
>
> Is there anyone in the community that can assist with this?

We don’t always notice all messages. Feel free to send a reminder after some days. 21 days was many 🙂

I also edited your question to make it more readable. That can also get you more answers. Follow this guide next time to format your post: [How to format your forum posts](https://forums.docker.com/t/how-to-format-your-forum-posts/127295)

---

<div class="post-metadata">

**Author:** ![tomfrye](https://avatars.discourse-cdn.com/v4/letter/t/9f8e36/32.png) [@tomfrye](https://forums.docker.com/u/tomfrye)\
**Post date:** [June 11, 2024, 4:14pm UTC](https://forums.docker.com/t/docker-rootless-permission-errort/141572/4 "2024-06-11T16:14:28Z")

</div>

Yes, the Install Docker Engine on RHEL to and extent, but I’m focused on ROOTLESS functionality, using these instructions, [Run the Docker daemon as a non-root user (Rootless mode) | Docker Docs](https://docs.docker.com/engine/security/rootless/)

- the goal is to allow our normal users (non-privileged) to be able to run docker as themselves.
- I will try a newer version of the Docker packages.  
Thank you for the reply.

---

<div class="post-metadata">

**Author:** ![tomfrye](https://avatars.discourse-cdn.com/v4/letter/t/9f8e36/32.png) [@tomfrye](https://forums.docker.com/u/tomfrye)\
**Post date:** [June 12, 2024, 3:38pm UTC](https://forums.docker.com/t/docker-rootless-permission-errort/141572/5 "2024-06-12T15:38:22Z")

</div>

Hello,  
Updated my repo with latest packages, then updated my client to 26.1.4  
Output from running $ docker info is below…

$ docker info  
Client: Docker Engine - Community  
Version: 26.1.4  
Context: rootless  
Debug Mode: false  
Plugins:  
buildx: Docker Buildx (Docker Inc.)  
Version: v0.14.1  
Path: /usr/libexec/docker/cli-plugins/docker-buildx  
compose: Docker Compose (Docker Inc.)  
Version: v2.27.1  
Path: /usr/libexec/docker/cli-plugins/docker-compose

Server:  
Containers: 0  
Running: 0  
Paused: 0  
Stopped: 0  
Images: 0  
Server Version: 26.1.4  
Storage Driver: fuse-overlayfs  
Logging Driver: json-file  
Cgroup Driver: none  
Cgroup Version: 1  
Plugins:  
Volume: local  
Network: bridge host ipvlan macvlan null overlay  
Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog  
Swarm: inactive  
Runtimes: io.containerd.runc.v2 runc  
Default Runtime: runc  
Init Binary: docker-init  
containerd version: d2d58213f83a351ca8f528a95fbd145f5654e957  
runc version: v1.1.12-0-g51d5e94  
init version: de40ad0  
Security Options:  
seccomp  
Profile: builtin  
rootless  
Kernel Version: 4.18.0-553.5.1.el8\_10.x86\_64  
Operating System: Red Hat Enterprise Linux 8.10 (Ootpa)  
OSType: linux  
Architecture: x86\_64  
CPUs: 12  
Total Memory: 30.85GiB  
Name: rhel02  
ID: e25497ad-a413-478a-8e8d-4da56965a81c  
Docker Root Dir: /home/user01@our.domain.com/.local/share/docker  
Debug Mode: false  
Experimental: false  
Insecure Registries:  
127.0.0.0/8  
Live Restore Enabled: false

WARNING: Running in rootless-mode without cgroups. To enable cgroups in rootless-mode, you need to boot the system in cgroup v2 mode.  
WARNING: bridge-nf-call-iptables is disabled  
WARNING: bridge-nf-call-ip6tables is disabled

---

<div class="post-metadata">

**Author:** ![rimelek](https://sea3.discourse-cdn.com/docker/user_avatar/forums.docker.com/rimelek/32/41602_2.png) [@rimelek](https://forums.docker.com/u/rimelek)\
**Post date:** [June 12, 2024, 7:57pm UTC](https://forums.docker.com/t/docker-rootless-permission-errort/141572/6 "2024-06-12T19:57:11Z")

</div>

Again…

* * *

Please, format your post according to the following guide: [How to format your forum posts](https://forums.docker.com/t/how-to-format-your-forum-posts/127295)  
In short: please, use `</>` button to share codes, terminal outputs, error messages or anything that can contain special characters which would be interpreted by the MarkDown filter. Use the preview feature to make sure your text is formatted as you would expect it and check your post after you have sent it so you can still fix it.

Example code block:

````auto
```
echo "I am a code."
echo "An athletic one, and I wanna run."
```

````

* * *
