4

I have a user restricted, and the user can only access its own files. It is a non-root user, and so, therefore, cannot use Docker (doing docker run foo => docker: Got permission denied while trying to connect to the Docker daemon socket...).

I want to allow this user to create their own Docker images from only their file space, and only be able to delete/rmi their own images that they have made. Furthermore, they will only be able to run their own images and stop their own image containers.

From the questions I have read, the only way for this to happen is to add a root user to a group the non-root user is in, making a huge vulnerability risk.

4 Answers 4

3

From the excellent answer found here:

Good news: the new docker (version 19.03 (currently experimental)) will be able to run rootless negating the problems that can occur using a root user. No more messing with elevated permissions, root and anything that might open up your machine when you did not want to.

Video about this from [DockerCon 2019] Hardening Docker daemon with Rootless mode

A few Caveats to the rootless Docker mode

Docker engineers say the rootless mode cannot be considered a replacement for the complete suite of Docker engine features. Some limitation to the rootless mode include:

  • cgroups resource controls, apparmor security profiles, checkpoint/restore, overlay networks etc. do not work on rootless mode.
  • Exposing ports from containers currently requires manual socat helper process.
  • Only Ubuntu-based distros support overlay filesystems in rootless mode.
  • Rootless mode is currently only provided for nightly builds that may not be as stable as you are used to.

As of docker 19.3 this is obsolete (and more dangerous than need be):

The docker manual has this to say about it:

Giving non-root access

The docker daemon always runs as the root user, and since Docker version 0.5.2, the docker daemon binds to a Unix socket instead of a TCP port. By default that Unix socket is owned by the user root, and so, by default, you can access it with sudo.

Starting in version 0.5.3, if you (or your Docker installer) create a Unix group called docker and add users to it, then the docker daemon will make the ownership of the Unix socket read/writable by the docker group when the daemon starts. The docker daemon must always run as the root user, but if you run the docker client as a user in the docker group then you don't need to add sudo to all the client commands. As of 0.9.0, you can specify that a group other than docker should own the Unix socket with the -G option.

Warning: The docker group (or the group specified with -G) is root-equivalent; see Docker Daemon Attack Surface details and this blogpost on Why we don't let non-root users run Docker in CentOS, Fedora, or RHEL (thanks michael-n).

In the recent release of the experimental rootless mode on GitHub, engineers mention rootless mode allows running dockerd as an unprivileged user, using user_namespaces(7), mount_namespaces(7), network_namespaces(7).

Users need to run dockerd-rootless.sh instead of dockerd.

$ dockerd-rootless.sh --experimental

As Rootless mode is experimental, users need to always run dockerd-rootless.sh with –experimental.


Important to read: post-installation steps for Linux (it also links to Docker Daemon Attack Surface details).

Manage Docker as a non-root user

The docker daemon binds to a Unix socket instead of a TCP port. By default that Unix socket is owned by the user root and other users can only access it using sudo. The docker daemon always runs as the root user.

If you don’t want to use sudo when you use the docker command, create a Unix group called docker and add users to it. When the docker daemon starts, it makes the ownership of the Unix socket read/writable by the docker group.


  • Add the docker group if it doesn't already exist:

     sudo groupadd docker
    
  • Add the connected user "$USER" to the docker group. Change the user name to match your preferred user if you do not want to use your current user:

     sudo gpasswd -a $USER docker
    
  • Either do a newgrp docker or log out/in to activate the changes to groups.

  • You can use

     docker run hello-world
    

    to check if you can run docker without sudo.

2
  • Hi, thanks for answering. I have somewhat got this up and running well, however, there is this glaring question, if you could verify if it's possible? Is it possible to individual users to be able to build, run and stop only their images/containers? Sep 17, 2019 at 12:18
  • You can test by creating a test user account with appropriate permissions and go through the creation steps. After you are satisfied with test user operations then deploy to production (regular) users. Sep 17, 2019 at 12:36
1

Per the Official Docker Documentation,

Running containers (and applications) with Docker implies running the Docker daemon. This daemon requires root privileges unless you opt-in to Rootless mode (experimental)...

Instructions for this mode can be found on GitHub:

https://github.com/docker/engine/blob/v19.03.0-rc3/docs/rootless.md

I want to allow this user to create their own Docker images from only their file space, and only be able to delete/rmi their own images that they have made.

If you are only seeking to build containers, one could try using img,

Standalone, daemon-less, unprivileged Dockerfile and OCI compatible container image builder.

This tool can be used for building containers, and runs without permissions by default.

Furthermore, they will only be able to run their own images and stop their own image containers.

Unfortunately, as stated previously, img cannot run containers, only build them.

See also: https://rootlesscontaine.rs

2
  • Thank you for answering. With Docker or img, is not possible for: '[users will] only be able to run their own images and stop their own image containers'? Sep 17, 2019 at 12:17
  • Definitely not with img since it cannot run containers; with Docker, they will be able to start and stop any container.
    – oxr463
    Sep 17, 2019 at 13:42
1

docker run foo => docker: Got permission denied while trying to connect to the Docker daemon socket...

Seems like when create the socket without enough permission for the docker group. The error start again and again and re-execute the command each time. This really hard open security hole of chmod after each reboot.

The Problem is from SystemD cause the socket will be create only with root:root . You can check it with this :

ls -l /lib/systemd/system/docker.socket

If this is good you should see this root:docker not root:root.

The Solution from this issues. You can try do this job :

$sudo chgrp docker /lib/systemd/system/docker.socket
$sudo chmod g+w /lib/systemd/system/docker.socket
$sudo chmod 666 /var/run/docker.sock

This should be work if you are in graphical environment and probably the only user on your computer. This case need a reboot.

Hope this Helps.

0

Manage Docker as a non-root user By default the Unix socket is owned by the user root and other users can only access it using sudo. The docker daemon always runs as the root user. If you don't want to use sudo when you use the docker command, create a Unix group called docker and add users to it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.