The mechanism by which adding a user to group
docker grants permission to run docker is to get access to the socket of docker at
/var/run/docker.sock. If the filesystem that contains
/var/run has been mounted with ACLs enabled, this can also be achieved via ACLs.
sudo setfacl -m user:username:rw /var/run/docker.sock
I'm only including this for completeness.
In general, I recommend to avoid ACLs whenever a good alternative based on groups is available: It is better if the privileges in a system can be understood by looking at group memberships only. Having to scan the file system for ACL entries in order to understand system privileges is an additional burden for security audits.
Warning 1: This has the same
root equivalence as adding
username to the
docker group. You can still start a container in a way that has
root access to the host filesystem.
Warning 2: ACLs are significantly more difficult for security audits than group-based security. Probably avoid ACLs if possible when you can use groups instead, at least in audit-relevant environments.