d-s in rootless docker?

[musliner]

How hard would it be (or is it impossible) to make d-s work in a rootless docker install?

Out of the box, it dies with the error shown below. I'm not sure if that's the first of many insurmountable issues, or something minor that can be avoided with existing flags, etc...

OCI runtime create failed: container_linux.go:380: starting container process caused: process_linux.go:545: container init caused: write sysctl key net.ipv4.ping_group_range: write /proc/sys/net/ipv4/ping_group_range

[kcq]

Good question... Need to investigate how to reduce the privileges for the temporary container and the sensor that gets inserted.

[KannebTo]

Hi, any updates on this? I get this error:

cmd=build info=event.error status='received' data='SensorError{Op:sensor.fanotify.Run/fanapi.Initialize,Kind:call.error,Wrapped:{Type=syscall.Errno,Info=operation not permitted,Line:48,File:github.com/docker-slim/docker-slim/pkg/app/sensor/monitors/fanotify/monitor.go}}'

man fanotify_init says:

Calling fanotify_init() requires the CAP_SYS_ADMIN capability.

But sudo setcap cap_sys_admin-ep $(which docker-slim) or the same on rootlesskit doesn't help.