在 Void Linux 上用 Turnstile 运行 Rootless Docker

#!/bin/sh
set -eu

# ============================================================
# RootlessKit 子进程
# ============================================================

if [ -n "${_DOCKERD_ROOTLESS_CHILD:-}" ]; then
    # /run 已由 RootlessKit copy-up，在子命名空间中清理旧路径
    rm -f /run/docker /run/containerd /run/xtables.lock

    # 默认使用当前进程的网络命名空间。
    # 启用 --detach-netns 时优先使用 RootlessKit 保存的 netns。
    netns="/proc/self/ns/net"

    if [ -n "${ROOTLESSKIT_STATE_DIR:-}" ] &&
       [ -e "$ROOTLESSKIT_STATE_DIR/netns" ]; then
        netns="$ROOTLESSKIT_STATE_DIR/netns"
    fi

    # Docker bridge 和 nftables 需要网络命名空间开启转发
    nsenter --net="$netns" -- \
        sysctl -w net.ipv4.ip_forward=1 >/dev/null

    nsenter --net="$netns" -- \
        sysctl -w net.ipv6.conf.all.forwarding=1 >/dev/null 2>&1 || true

    exec dockerd "$@"
fi

# ============================================================
# RootlessKit 父进程
# ============================================================

if [ "$(id -u)" = "0" ]; then
    echo "错误：不能以 root 身份运行 rootless Docker" >&2
    exit 1
fi

if [ -z "${XDG_RUNTIME_DIR:-}" ]; then
    echo "错误：XDG_RUNTIME_DIR 未设置" >&2
    exit 1
fi

if [ ! -d "$XDG_RUNTIME_DIR" ] ||
   [ ! -w "$XDG_RUNTIME_DIR" ]; then
    echo "错误：XDG_RUNTIME_DIR 不存在或不可写：$XDG_RUNTIME_DIR" >&2
    exit 1
fi

if [ -z "${HOME:-}" ] || [ ! -d "$HOME" ]; then
    echo "错误：HOME 未设置或目录不存在" >&2
    exit 1
fi

# ============================================================
# 查找 RootlessKit
# ============================================================

rootlesskit_bin=""

for candidate in docker-rootlesskit rootlesskit; do
    if command -v "$candidate" >/dev/null 2>&1; then
        rootlesskit_bin="$candidate"
        break
    fi
done

if [ -z "$rootlesskit_bin" ]; then
    echo "错误：找不到 docker-rootlesskit 或 rootlesskit" >&2
    exit 1
fi

# ============================================================
# pasta 配置
# ============================================================

net="${DOCKERD_ROOTLESS_ROOTLESSKIT_NET:-pasta}"

if [ "$net" = "pasta" ] &&
   ! command -v pasta >/dev/null 2>&1; then
    echo "错误：配置了 pasta 网络，但系统中找不到 pasta 命令" >&2
    exit 1
fi

mtu="${DOCKERD_ROOTLESS_ROOTLESSKIT_MTU:-65520}"

if [ -n "${DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER:-}" ]; then
    port_driver="$DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER"
elif [ "$net" = "pasta" ]; then
    port_driver="implicit"
else
    port_driver="builtin"
fi

# RootlessKit 官方建议 pasta 与 implicit 端口驱动配合使用
if [ "$net" = "pasta" ] && [ "$port_driver" != "implicit" ]; then
    echo "警告：pasta 通常应配合 --port-driver=implicit" >&2
fi

# ============================================================
# detach-netns
# ============================================================

detach_flag=""

case "${DOCKERD_ROOTLESS_ROOTLESSKIT_DETACH_NETNS:-true}" in
    1|true|yes|on)
        detach_flag="--detach-netns"
        ;;
    0|false|no|off)
        detach_flag=""
        ;;
    *)
        echo "错误：无效的 DETACH_NETNS 值" >&2
        exit 1
        ;;
esac

# ============================================================
# 宿主机回环访问
# ============================================================

host_loopback_flag=""

case "${DOCKERD_ROOTLESS_ALLOW_HOST_LOOPBACK:-false}" in
    1|true|yes|on)
        # 不传 --disable-host-loopback。
        #
        # 对 pasta 而言，这意味着 RootlessKit 不会给 pasta 添加：
        #
        #   --no-map-gw
        #
        # 容器可通过 10.0.2.2 访问宿主机 127.0.0.1 服务。
        host_loopback_flag=""
        ;;
    0|false|no|off)
        host_loopback_flag="--disable-host-loopback"
        ;;
    *)
        echo "错误：无效的 ALLOW_HOST_LOOPBACK 值" >&2
        exit 1
        ;;
esac

# ============================================================
# 启动 RootlessKit
# ============================================================

state_dir="$XDG_RUNTIME_DIR/dockerd-rootless"

mkdir -p "$state_dir"

export _DOCKERD_ROOTLESS_CHILD=1

exec "$rootlesskit_bin" \
    --state-dir="$state_dir" \
    --net="$net" \
    --mtu="$mtu" \
    --port-driver="$port_driver" \
    --copy-up=/etc \
    --copy-up=/run \
    --propagation=rslave \
    ${host_loopback_flag:+$host_loopback_flag} \
    ${detach_flag:+$detach_flag} \
    "$0" "$@"