fix error when docker daemon is running with user namespace enabled.

[jjqq2013]

Hi, i have my docker daemon run with user namespace enabled(All users in containers will be mapped to sub user of specified external user),

When i start /usr/local/bin/scope, it reports

1:"Privileged mode is incompatible with user namespaces".

Then modify the script, add --userns=host to let it share user namespace with host.

2:"Cannot share the host's network namespace when user namespaces are enabled".

The same reason and solution with 1.

That's all, hope helpful.

[2opremio]

Thanks for this!

This change assumes that the running Docker Engine version is >= 1.10 , which is "only" one year old (some distros may not have caught up).

@QianJin2013 Could you conditionally incorporate the --userns=host flag only if the docker engine version is >= 1.10 ?

[2opremio]

@bboreham You may want to take this into consideration for Weave Net as well.

[rade]

TBH, I reckon mandating Docker >=1.10 is fine - Weave Net will do that from the next release onwards anyway.

[2opremio]

@rade Will you explicitly be checking the Docker version on launch or is it implicit?

[rade]

no idea. @bboreham will know.

[jjqq2013]

ok, i will add a check whether or not support --userns=host

[2opremio]

@QianJin2013 Hold on, it may not be necessary. It seems almost all users run >= 1.10 anyways

[jjqq2013]

@2opremio yeah, not much necessary.

If anyone want, i will use

docker run --help |grep -q -- --userns && USERNS_HOST="--userns=host"

[alban]

Since $USERNS_HOST can be empty and in that case we don't want it to be considered a parameter, I think you will need to add # shellcheck disable=SC2086 just before using it the second time so that CircleCI can run shellcheck correctly.

See also https://github.com/koalaman/shellcheck/wiki/SC2086

[jjqq2013]

@alban OK, added shellcheck disable=SC2086, rebased, conflict resolved.

[bboreham]

It seems that --userns=host was added in Docker 1.11, not in 1.10 - moby/moby#20111

So your current proposed mitigation is workable; the original assumption that since we mandate 1.10 we're ok is not.

[jjqq2013]

anyway, for docker which does not support --userns, this patch also works without error.

[2opremio]

anyway, for docker which does not support --userns, this patch also works without error.

Fair enough.

LGTM, modulo a descriptive comment. @QianJin2013 I will merge after you add it.

[jjqq2013]

ok, comment added. Seems too long, i am not good at english, sorry.

[jjqq2013]

OK, added