---
name: "docker-rootless-daemon-hardening"
description: "Run the Docker daemon and containers completely without root privileges to mitigate breakouts."
metadata:
  author: "Moby Project"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "install docker rootless"
  - "setup rootless subuid subgid"
  - "harden docker daemon security"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Docker Rootless Daemon Installation & Security Hardening

Deploys rootless Docker: setting up user namespaces (subuid/subgid), systemd user services, rootlesskit port forwarding, slirp4netns networking, and securing container daemon sockets against privilege escalation.

## When to Invoke
Invoke this skill whenever you need to:
- install docker rootless
- setup rootless subuid subgid
- harden docker daemon security

## Execution SOP & Rules
1. Check kernel requirements: ensure unprivileged user namespaces are enabled in sysctl.
2. Run dockerd-rootless-setuptool.sh install under the target unprivileged user account.
3. Export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/docker.sock in shell profile (.bashrc).
4. Verify user namespace remapping inside running containers: docker run --rm alpine id.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.