Rootless mode runs both the Docker daemon and your containers as a non-root user inside a user namespace. You need newuidmap and newgidmap plus at least 65,536 subordinate UIDs and GIDs for your user. Install with the setup tool, then confirm with docker info.
What it changes
Docker's documentation says rootless mode reduces the impact of vulnerabilities in the daemon and the container runtime. It is different from userns-remap, where the daemon still runs as root. In rootless mode both the daemon and the containers run without root privileges.
It uses no SETUID binaries or file capabilities, except newuidmap and newgidmap.
On a developer laptop that matters because a container escape or a daemon bug lands in an unprivileged account rather than on the root user.
Prerequisites
Docker lists two:
- newuidmap and newgidmap installed, usually from the uidmap package.
- At least 65,536 subordinate UIDs and GIDs for your user in /etc/subuid and /etc/subgid.
Root is not needed for installation if those are met.
Install steps
If the system-wide Docker service is running, Docker suggests disabling it first:
sudo systemctl disable --now docker.service docker.socket
Remove /var/run/docker.sock too. If you keep the system service running, add the force flag at the setup step.
With the RPM or DEB packages on Docker 20.10 or later, run this as a non-root user:
dockerd-rootless-setuptool.sh install
If the script is missing, install docker-ce-rootless-extras. Without packages, Docker documents a script from its install host that places binaries in ~/bin. Read any script you pipe into a shell before you run it.
The installer prints PATH and, if needed, DOCKER_HOST values. Set them.
Verify it worked
Run docker info. It should show the rootless context and a rootless security option. If it does not, you are probably talking to the old system daemon.
To start the daemon at boot rather than at login, Docker says to run:
sudo loginctl enable-linger YOUR_USER
What to expect
Docker's page has no dedicated limitations section, so test your own workflow. Anything that needs privileged ports, specific storage drivers or host networking behaviour may need adjustment. Check the full documentation for your Docker version rather than assuming parity with the rootful daemon.
Pair it with image scanning
Rootless limits what a compromised container can do on the host. It does nothing about vulnerable packages inside an image. Scanning images before you run them is a separate control, and you can see how that looks in the demo below.
Click through it at your own pace, or open it full screen.
Quick check
Is rootless mode the same as userns-remap?
No. With userns-remap the daemon still runs as root. In rootless mode both the daemon and containers run without root.
How do I know I am really rootless?
Run docker info and look for the rootless context and security option.
Sources
Last reviewed: 19 October 2026.
