Skip to content

rootless notes #577

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
yorickdowne merged 2 commits into from
May 15, 2026
+73 −3
Merged

rootless notes #577

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2681708
Changelog for v26.5.0
yorickdowne May 12, 2026
46ab110
rootless notes
yorickdowne May 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
54 changes: 54 additions & 0 deletions website/docs/About/Changelog.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,60 @@ instead.
> If you do wish to manually update your local reference, run `git remote set-url origin https://github.com/ethstaker/eth-docker.git`


## v26.5.0 2026-05-12

*This is a recommended release*

**Breaking changes**
- Ethrex and max blobs requires Ethrex `10.0.0` or later
- Nethermind and max blobs requires Nethermind `1.37.0` or later
- Besu and max blobs requires Besu `26.4.0` or later
- Erigon and max blobs requires Erigon `3.4.0` or later
- Require Reth `2.2.0` or later
- Grandine Nethermind plugin requires `1.37.0` or later
- Nethermind and FlatDB requires `1.37.1` or later
- Vero source build requires `1.4.0` or later

**Changes**

- Better Reth download handling, requires Reth `2.1.0` or later
- Support Reth DB migration to v2, requires Reth `2.1.0` or later
- Support Nethermind FlatDB
- Support a multi-user setup with `eve` owning the Eth Docker directory, and `alice` and `bob` having the ability to administer
Eth Docker, when all three are in a common group such as `node-admins` and that group has write rights to the Eth Docker directory
- `./ethd update --no-screen` if you'd like to run `./ethd update` and not have it spawn a `screen` session
- Support Ethrex max blobs, requires Ethrex `10.0.0` or later
- Support Nethermind max blobs, requires `1.37.0` or later
- Support Besu max blobs, requires `26.4.0` or later
- Support Erigon max blobs, requires `3.4.0` or later
- Support Web3signer distroless image, including read-only Docker parameter
- Provisioned Grafana alerts no longer fire on "No Data"
- Support changed Grandine Nethermind plugin parameters
- Progress counter for key import and deletion
- Add command to reduce security of web3signer keys. Use on testnet, only!
- Bump Besu and Teku build to Java 25
- Nag user if their Docker-CE is old, to guard against accidentally disabled 3rd party repo
- Reth uses the same port for discv4 and discv5
- Remove Manifold finance relay
- Enable UI access to Obol Alloy
- Support Vero source build on `1.4.0` or later. Thanks @eth2353!
- `ETH_DOCKER_TAG=stable` will always pull the latest release version during `./ethd update`, instead of the current `-dev` version
- Cleaner node exporter configuration
- Grandine source builds can optionally pull in a host-built binary instead of building inside the container

**Bug fixes**
- Obol Alloy service is now distinct from generic Alloy service
- `./ethd update` handles migration from Obol promtail to Obol Alloy
- Obol Alloy correctly delivers Charon metrics
- `./ethd keys import --non-interactive` now actually is
- `./ethd install` adjusts `.motd` to the actual directory Eth Docker is in
- `./ethd prune-history` works correctly with Nethermind
- Prysm archive node backfills to slot 0
- Do not mount `$DOCKER_ROOT/containers` into Alloy
- `./ethd install` correctly handles chrony leap seconds on Ubuntu 26.04
- Remove `./ethd update` lock file on failure


## v26.4.1 2026-04-19

*This is a recommended release for Vero users*
Expand Down
22 changes: 19 additions & 3 deletions website/docs/Usage/Prerequisites.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -211,15 +211,31 @@ sudo docker ps

## rootless Docker

Eth Docker is limited with [rootless Docker](https://docs.docker.com/engine/security/rootless/). Containers
won't start until the user is logged in, and I am unsure how to handle iptables so host-mapped P2P ports work.
Eth Docker works with [rootless Docker](https://docs.docker.com/engine/security/rootless/) since version 29.5.0.
IPv4/IPv6 dual-stack works in rootless mode in testing.

If using Grafana, use `grafana-rootless.yml` instead of `grafana.yml`. This omits node-exporter and cadvisor.
To make sure that P2P traffic on the CL and EL works, including incoming peers, and the services start after reboot
without the user logging in, install it like this:
```
sudo systemctl disable --now docker docker.socket
sudo rm -f /var/run/docker.sock
sudo modprobe br_netfilter
echo "br_netfilter" | sudo tee /etc/modules-load.d/br_netfilter.conf
echo "net.ipv4.ip_forward=1" | sudo tee /etc/sysctl.d/10-ip-forward.conf
sudo sysctl --system
mkdir -p ~/.config/docker
echo '{"userland-proxy":false}' >~/.config/docker/daemon.json
dockerd-rootless-setuptool.sh install
sudo loginctl linger $(id -un)
```

If using Grafana, use `grafana-rootless.yml` instead of `grafana.yml`. This omits node-exporter and cadvisor.

If using traefik, either change its ports in `.env` to be above `1024`, or
[expose privileged ports](https://docs.docker.com/engine/security/rootless/#exposing-privileged-ports).

`ufw`, if installed, will control all ports when in rootless mode. Be sure to allow the P2P ports in, UDP and TCP both.

## macOS Prerequisites

> The following prerequisites apply if you are going to use macOS as a server to run an Ethereum staking full node. If
Expand Down