@@ -9,12 +9,11 @@ import (

 	"github.com/docker/docker/daemon/config"

 	"github.com/docker/docker/opts"

 	"github.com/docker/docker/pkg/homedir"

-	"github.com/docker/docker/rootless"

 	"github.com/spf13/pflag"

 )

 func getDefaultPidFile() (string, error) {

-	if !rootless.RunningWithNonRootUsername() {

+	if !honorXDG {

 		return "/var/run/docker.pid", nil

 	}

 	runtimeDir, err := homedir.GetRuntimeDir()

@@ -25,7 +24,7 @@ func getDefaultPidFile() (string, error) {

 }

 func getDefaultDataRoot() (string, error) {

-	if !rootless.RunningWithNonRootUsername() {

+	if !honorXDG {

 		return "/var/lib/docker", nil

 	}

 	dataHome, err := homedir.GetDataHome()

@@ -36,7 +35,7 @@ func getDefaultDataRoot() (string, error) {

 }

 func getDefaultExecRoot() (string, error) {

-	if !rootless.RunningWithNonRootUsername() {

+	if !honorXDG {

 		return "/var/run/docker", nil

 	}

 	runtimeDir, err := homedir.GetRuntimeDir()

@@ -3,10 +3,13 @@

 package main

 import (

+	"os/exec"

+

 	"github.com/docker/docker/daemon/config"

 	"github.com/docker/docker/opts"

 	"github.com/docker/docker/rootless"

 	"github.com/docker/go-units"

+	"github.com/pkg/errors"

 	"github.com/spf13/pflag"

 )

@@ -35,7 +38,16 @@ func installConfigFlags(conf *config.Config, flags *pflag.FlagSet) error {

 	flags.BoolVar(&conf.BridgeConfig.EnableIPv6, "ipv6", false, "Enable IPv6 networking")

 	flags.StringVar(&conf.BridgeConfig.FixedCIDRv6, "fixed-cidr-v6", "", "IPv6 subnet for fixed IPs")

 	flags.BoolVar(&conf.BridgeConfig.EnableUserlandProxy, "userland-proxy", true, "Use userland proxy for loopback traffic")

-	flags.StringVar(&conf.BridgeConfig.UserlandProxyPath, "userland-proxy-path", "", "Path to the userland proxy binary")

+	defaultUserlandProxyPath := ""

+	if rootless.RunningWithRootlessKit() {

+		var err error

+		// use rootlesskit-docker-proxy for exposing the ports in RootlessKit netns to the initial namespace.

+		defaultUserlandProxyPath, err = exec.LookPath(rootless.RootlessKitDockerProxyBinary)

+		if err != nil {

+			return errors.Wrapf(err, "running with RootlessKit, but %s not installed", rootless.RootlessKitDockerProxyBinary)

+		}

+	}

+	flags.StringVar(&conf.BridgeConfig.UserlandProxyPath, "userland-proxy-path", defaultUserlandProxyPath, "Path to the userland proxy binary")

 	flags.StringVar(&conf.CgroupParent, "cgroup-parent", "", "Set parent cgroup for all containers")

 	flags.StringVar(&conf.RemappedRoot, "userns-remap", "", "User/Group setting for user namespaces")

 	flags.BoolVar(&conf.LiveRestoreEnabled, "live-restore", false, "Enable live restore of docker when containers are still running")

@@ -49,7 +61,8 @@ func installConfigFlags(conf *config.Config, flags *pflag.FlagSet) error {

 	flags.BoolVar(&conf.NoNewPrivileges, "no-new-privileges", false, "Set no-new-privileges by default for new containers")

 	flags.StringVar(&conf.IpcMode, "default-ipc-mode", config.DefaultIpcMode, `Default mode for containers ipc ("shareable" | "private")`)

 	flags.Var(&conf.NetworkConfig.DefaultAddressPools, "default-address-pool", "Default address pools for node specific local networks")

-	// Mostly users don't need to set this flag explicitly.

-	flags.BoolVar(&conf.Rootless, "rootless", rootless.RunningWithNonRootUsername(), "Enable rootless mode (experimental)")

+	// rootless needs to be explicitly specified for running "rootful" dockerd in rootless dockerd (#38702)

+	// Note that defaultUserlandProxyPath and honorXDG are configured according to the value of rootless.RunningWithRootlessKit, not the value of --rootless.

+	flags.BoolVar(&conf.Rootless, "rootless", rootless.RunningWithRootlessKit(), "Enable rootless mode; typically used with RootlessKit (experimental)")

 	return nil

 }

@@ -103,6 +103,12 @@ func (cli *DaemonCli) start(opts *daemonOptions) (err error) {

 		if cli.Config.IsRootless() {

 			logrus.Warn("Running in rootless mode. Cgroups, AppArmor, and CRIU are disabled.")

 		}

+		if rootless.RunningWithRootlessKit() {

+			logrus.Info("Running with RootlessKit integration")

+			if !cli.Config.IsRootless() {

+				return fmt.Errorf("rootless mode needs to be enabled for running with RootlessKit")

+			}

+		}

 	} else {

 		if cli.Config.IsRootless() {

 			return fmt.Errorf("rootless mode is supported only when running in experimental mode")

@@ -591,7 +597,7 @@ func loadListeners(cli *DaemonCli, serverConfig *apiserver.Config) ([]string, er

 	var hosts []string

 	for i := 0; i < len(cli.Config.Hosts); i++ {

 		var err error

-		if cli.Config.Hosts[i], err = dopts.ParseHost(cli.Config.TLS, rootless.RunningWithNonRootUsername(), cli.Config.Hosts[i]); err != nil {

+		if cli.Config.Hosts[i], err = dopts.ParseHost(cli.Config.TLS, honorXDG, cli.Config.Hosts[i]); err != nil {

 			return nil, errors.Wrapf(err, "error parsing -H %s", cli.Config.Hosts[i])

 		}

@@ -668,9 +674,9 @@ func validateAuthzPlugins(requestedPlugins []string, pg plugingetter.PluginGette

 	return nil

 }

-func systemContainerdRunning(isRootless bool) (string, bool, error) {

+func systemContainerdRunning(honorXDG bool) (string, bool, error) {

 	addr := containerddefaults.DefaultAddress

-	if isRootless {

+	if honorXDG {

 		runtimeDir, err := homedir.GetRuntimeDir()

 		if err != nil {

 			return "", false, err

@@ -18,14 +18,13 @@ import (

 	"github.com/docker/docker/daemon/config"

 	"github.com/docker/docker/libcontainerd/supervisor"

 	"github.com/docker/docker/pkg/homedir"

-	"github.com/docker/docker/rootless"

 	"github.com/docker/libnetwork/portallocator"

 	"github.com/pkg/errors"

 	"golang.org/x/sys/unix"

 )

 func getDefaultDaemonConfigDir() (string, error) {

-	if !rootless.RunningWithNonRootUsername() {

+	if !honorXDG {

 		return "/etc/docker", nil

 	}

 	// NOTE: CLI uses ~/.docker while the daemon uses ~/.config/docker, because

@@ -148,7 +147,7 @@ func newCgroupParent(config *config.Config) string {

 func (cli *DaemonCli) initContainerD(ctx context.Context) (func(time.Duration) error, error) {

 	var waitForShutdown func(time.Duration) error

 	if cli.Config.ContainerdAddr == "" {

-		systemContainerdAddr, ok, err := systemContainerdRunning(cli.Config.IsRootless())

+		systemContainerdAddr, ok, err := systemContainerdRunning(honorXDG)

 		if err != nil {

 			return nil, errors.Wrap(err, "could not determine whether the system containerd is running")

 		}

@@ -10,11 +10,16 @@ import (

 	"github.com/docker/docker/pkg/jsonmessage"

 	"github.com/docker/docker/pkg/reexec"

 	"github.com/docker/docker/pkg/term"

+	"github.com/docker/docker/rootless"

 	"github.com/moby/buildkit/util/apicaps"

 	"github.com/sirupsen/logrus"

 	"github.com/spf13/cobra"

 )

+var (

+	honorXDG bool

+)

+

 func newDaemonCommand() (*cobra.Command, error) {

 	opts := newDaemonOptions(config.New())

@@ -53,6 +58,14 @@ func init() {

 	if dockerversion.ProductName != "" {

 		apicaps.ExportedProduct = dockerversion.ProductName

 	}

+	// When running with RootlessKit, $XDG_RUNTIME_DIR, $XDG_DATA_HOME, and $XDG_CONFIG_HOME needs to be

+	// honored as the default dirs, because we are unlikely to have permissions to access the system-wide

+	// directories.

+	//

+	// Note that even running with --rootless, when not running with RootlessKit, honorXDG needs to be kept false,

+	// because the system-wide directories in the current mount namespace are expected to be accessible.

+	// ("rootful" dockerd in rootless dockerd, #38702)

+	honorXDG = rootless.RunningWithRootlessKit()

 }

 func main() {

@@ -54,10 +54,9 @@ penguin:231072:65536

 You need to run `dockerd-rootless.sh` instead of `dockerd`.

 ```console

-$ dockerd-rootless.sh --experimental --userland-proxy --userland-proxy-path=$(which rootlesskit-docker-proxy)"

+$ dockerd-rootless.sh --experimental

 ```

 As Rootless mode is experimental per se, currently you always need to run `dockerd-rootless.sh` with `--experimental`.

-Also, to expose ports, you need to set `--userland-proxy-path` to the path of `rootlesskit-docker-proxy` binary.

 Remarks:

 * The socket path is set to `$XDG_RUNTIME_DIR/docker.sock` by default. `$XDG_RUNTIME_DIR` is typically set to `/run/user/$UID`.

@@ -45,13 +45,13 @@ func ValidateHost(val string) (string, error) {

 }

 // ParseHost and set defaults for a Daemon host string.

-// defaultToTLS is preferred over defaultToUnixRootless.

-func ParseHost(defaultToTLS, defaultToUnixRootless bool, val string) (string, error) {

+// defaultToTLS is preferred over defaultToUnixXDG.

+func ParseHost(defaultToTLS, defaultToUnixXDG bool, val string) (string, error) {

 	host := strings.TrimSpace(val)

 	if host == "" {

 		if defaultToTLS {

 			host = DefaultTLSHost

-		} else if defaultToUnixRootless {

+		} else if defaultToUnixXDG {

 			runtimeDir, err := homedir.GetRuntimeDir()

 			if err != nil {

 				return "", err

@@ -5,22 +5,21 @@ import (

 	"sync"

 )

+const (

+	// RootlessKitDockerProxyBinary is the binary name of rootlesskit-docker-proxy

+	RootlessKitDockerProxyBinary = "rootlesskit-docker-proxy"

+)

+

 var (

-	runningWithNonRootUsername     bool

-	runningWithNonRootUsernameOnce sync.Once

+	runningWithRootlessKit     bool

+	runningWithRootlessKitOnce sync.Once

 )

-// RunningWithNonRootUsername returns true if we $USER is set to a non-root value,

-// regardless to the UID/EUID value.

-//

-// The value of this variable is mostly used for configuring default paths.

-// If the value is true, $HOME and $XDG_RUNTIME_DIR should be honored for setting up the default paths.

-// If false (not only EUID==0 but also $USER==root), $HOME and $XDG_RUNTIME_DIR should be ignored

-// even if we are in a user namespace.

-func RunningWithNonRootUsername() bool {

-	runningWithNonRootUsernameOnce.Do(func() {

-		u := os.Getenv("USER")

-		runningWithNonRootUsername = u != "" && u != "root"

+// RunningWithRootlessKit returns true if running under RootlessKit namespaces.

+func RunningWithRootlessKit() bool {

+	runningWithRootlessKitOnce.Do(func() {

+		u := os.Getenv("ROOTLESSKIT_STATE_DIR")

+		runningWithRootlessKit = u != ""

 	})

-	return runningWithNonRootUsername

+	return runningWithRootlessKit

 }