Linux Docker root and rootless modes
This article provides an in-depth analysis of the core differences between Docker in Root mode and Rootless mode. Root mode operates at the system-wide level, storing data in `/var/lib/docker`. It offers full privileges but has lower security. Rootless mode runs with regular user permissions, isolates data within the user directory, and leverages user namespace technology to enhance security and enable independent instances for multiple users. However, it is limited by CPU and I/O constraints and certain network functionalities. The article points out that because the data storage and service configurations of the two modes are completely independent, they cannot share images and containers. Based on the current actual needs, which do not require advanced features, the author decided to disable Root mode and fully adopt Rootless mode. The text details how to manage user-level services using `systemctl --user`, corrects the misconception that `systemctl` is limited to system-level usage, and compares the configuration file paths, socket locations, and storage directories in both modes. Additionally, it discusses the Rootless capabilities of applications such as Podman and Caddy, summarizes the advantages and limitations of Rootless mode in development, testing, and shared hosting scenarios, and provides a practical guide for managing containers more securely and flexibly in a Linux environment.