2

I've installed Docker CE from the official apt repository. To grant regular users access to Docker, I've created a group docker and added each user to this group. Yet, whenever any user runs something within a container (docker run -d ...), the processes are run under my UID and the files they create have my ownership, e.g. myuser:myuser instead of anotheruser:anotheruser. When users explicitly specify their UIDs (docker run -d --user $UID ...), the processes are correctly registered with their UIDs, but the outputs belong to anotheruser:root. That group specification (i.e. root) troubles me quite a bit. What should I do to:

  1. Make other users run dockers under their UIDs only;
  2. Make their output register as anotheruser:anotheruser or anotheruser:docker.
2

Docker containers are run by the docker daemon, which runs as root. By default, the docker daemon runs containers as root. Using docker run --user={uid}:{gid}, the daemon can be told to run the container as a specific user and effective group.

Adding system users to the docker group gives them the privilege to interact with the docker daemon. This includes starting containers as root. Therefore, any user added to the docker group must be trusted.

Note that docker group users could mount the host's / inside the container, and thus have root access to the entire host file system. Hence the trust requirement.

In short, the answer to "how do I make users always run docker containers under their own user ID" is: by asking them to do so. Tell them to always invoke docker run as:

docker run --user=$(id -u):$(id -g) ...

Including uid and gid solves your second question. Note: the USER can as well be specified in the DockerFile defining the image, but then names a uid defined inside the container.

3

Docker is running as system wide, not on a specific user. That means any docker run will be run as root with the docker service.

If you see your ID inside a docker, this is probably because you have the ID 1000 which is the first user ID. Many Docker run their own service with a specific account, this account may most of the time use this same ID.

  • *"That means any docker run will be run as root with the docker service." – this looks like a massive security issue. And it seems very strange, that I can't prevent other users from running docker under my UID. That seems like another security issue. – Eli Korvigo Aug 8 '18 at 14:35
  • @EliKorvigo: it is not a security risk per se. Remember that you, the root user, have had to add these users to the docker group, without which they could not run any docker container (as this requires rootness). IOW you have entrusted them with root rights inasmuch as running Docker containers is concerned. As for the user ID: do not confuse the UID inside and outside the container. But yes, if the container wanted, they could touch files under your UID. This is why running containers should be a privilege for trusted users only. – zwets Aug 8 '18 at 18:29
  • Thank you for your answer. I've accepted @zwet's answer, because it is more elaborate. – Eli Korvigo Aug 9 '18 at 8:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.