diff --git a/content/rancher/v2.x/en/installation/ha-server-install-external-lb/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-external-lb/_index.md
index 868ce25ae97..5ff9d80fd12 100644
--- a/content/rancher/v2.x/en/installation/ha-server-install-external-lb/_index.md
+++ b/content/rancher/v2.x/en/installation/ha-server-install-external-lb/_index.md
@@ -187,18 +187,22 @@ Once you have the `rancher-cluster.yml` config file template, edit the nodes sec
2. Update the `nodes` section with the information of your [Linux hosts](#provision-linux-hosts).
- For each node in your cluster, update the following placeholders: `IP_ADDRESS_X` and `USER`.
+ For each node in your cluster, update the following placeholders: `IP_ADDRESS_X` and `USER`. The specified user should be able to access the Docket socket, you can test this by logging in with the specified user and run `docker ps`.
+
+ >**Note:**
+ > When using RHEL/CentOS, the SSH user can't be root due to https://bugzilla.redhat.com/show_bug.cgi?id=1527565. See [Operating System Requirements]({{< baseurl >}}/rke/v0.1.x/en/installation/os#redhat-enterprise-linux-rhel-centos) for RHEL/CentOS specific requirements.
+
```
nodes:
+ # The IP address or hostname of the node
- address: IP_ADDRESS_1
- # THE IP ADDRESS OR HOSTNAME OF THE NODE
+ # User that can login to the node and has access to the Docker socket (i.e. can execute `docker ps` on the node)
+ # When using RHEL/CentOS, this can't be root due to https://bugzilla.redhat.com/show_bug.cgi?id=1527565
user: USER
- # USER WITH ADMIN ACCESS. USUALLY `root`
role: [controlplane,etcd,worker]
+ # Path the SSH key that can be used to access to node with the specified user
ssh_key_path: ~/.ssh/id_rsa
- # PATH TO SSH KEY THAT AUTHENTICATES ON YOUR WORKSTATION
- # USUALLY THE VALUE ABOVE
- address: IP_ADDRESS_2
user: USER
role: [controlplane,etcd,worker]
diff --git a/content/rancher/v2.x/en/installation/ha-server-install/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/_index.md
index e2b416fcdf6..b0356a915d3 100644
--- a/content/rancher/v2.x/en/installation/ha-server-install/_index.md
+++ b/content/rancher/v2.x/en/installation/ha-server-install/_index.md
@@ -236,18 +236,22 @@ Once you have the `rancher-cluster.yml` config file template, edit the nodes sec
2. Update the `nodes` section with the information of your [Linux hosts](#provision-linux-hosts).
- For each node in your cluster, update the following placeholders: `IP_ADDRESS_X` and `USER`.
+ For each node in your cluster, update the following placeholders: `IP_ADDRESS_X` and `USER`. The specified user should be able to access the Docket socket, you can test this by logging in with the specified user and run `docker ps`.
+
+ >**Note:**
+ > When using RHEL/CentOS, the SSH user can't be root due to https://bugzilla.redhat.com/show_bug.cgi?id=1527565. See [Operating System Requirements]({{< baseurl >}}/rke/v0.1.x/en/installation/os#redhat-enterprise-linux-rhel-centos) for RHEL/CentOS specific requirements.
+
```
nodes:
+ # The IP address or hostname of the node
- address: IP_ADDRESS_1
- # THE IP ADDRESS OR HOSTNAME OF THE NODE
+ # User that can login to the node and has access to the Docker socket (i.e. can execute `docker ps` on the node)
+ # When using RHEL/CentOS, this can't be root due to https://bugzilla.redhat.com/show_bug.cgi?id=1527565
user: USER
- # USER WITH ADMIN ACCESS. USUALLY `root`
role: [controlplane,etcd,worker]
+ # Path the SSH key that can be used to access to node with the specified user
ssh_key_path: ~/.ssh/id_rsa
- # PATH TO SSH KEY THAT AUTHENTICATES ON YOUR WORKSTATION
- # USUALLY THE VALUE ABOVE
- address: IP_ADDRESS_2
user: USER
role: [controlplane,etcd,worker]
@@ -426,7 +430,7 @@ During installation, RKE automatically generates a config file named `kube_confi
You have a couple of options:
- Create a backup of your Rancher Server in case of a disaster scenario: [High Availablility Back Up and Restoration]({{< baseurl >}}/rancher/v2.x/en/installation/backups-and-restoration/ha-backup-and-restoration).
-- Create a Kubernetes cluster: [Creating a Cluster]({{ < baseurl > }}/rancher/v2.x/en/tasks/clusters/creating-a-cluster/).
+- Create a Kubernetes cluster: [Creating a Cluster]({{< baseurl >}}/rancher/v2.x/en/tasks/clusters/creating-a-cluster/).
diff --git a/content/rke/v0.1.x/en/installation/os/_index.md b/content/rke/v0.1.x/en/installation/os/_index.md
index 6c9af64ac81..30f7f5c1b4d 100644
--- a/content/rke/v0.1.x/en/installation/os/_index.md
+++ b/content/rke/v0.1.x/en/installation/os/_index.md
@@ -10,8 +10,40 @@ RKE runs on almost any Linux OS with Docker installed. Most of the development a
```
usermod -aG docker
```
+
+ See [Manage Docker as a non-root user](https://docs.docker.com/install/linux/linux-postinstall/#manage-docker-as-a-non-root-user) to see how you can configure access to Docker without using the `root` user.
- Swap should be disabled on any worker nodes
+### RedHat Enterprise Linux (RHEL) / CentOS
+
+If using RedHat Enterprise Linux or CentOS, you cannot use the `root` user as [SSH user]({{< baseurl >}}/rke/v0.1.x/en/config-options/nodes/#ssh-user) due to [Bugzilla 1527565](https://bugzilla.redhat.com/show_bug.cgi?id=1527565). If you are using the Docker package supplied by RedHat / CentOS, the `dockerroot` group is automatically added to the system. You will need to edit (or create) `/etc/docker/daemon.json` to include the following:
+
+```
+{
+ "group": "dockerroot"
+}
+```
+
+Restart Docker after editing or creating the file. After restarting Docker, you can check the group permission of the Docker socket (`/var/run/docker.sock`), which should show `dockerroot` as group:
+
+```
+srw-rw----. 1 root dockerroot 0 Jul 4 09:57 /var/run/docker.sock
+```
+
+Add the SSH user you want to use to this group, this can't be the `root` user.
+
+```
+usermod -aG dockerroot
+```
+
+To verify that the user is correctly configured, log out of the node and login with your SSH user, and execute `docker ps`:
+
+```
+ssh @node
+$ docker ps
+CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
+```
+
### Software
- Docker - Each Kubernetes version supports different Docker versions.