On Docker's documentation pages, all example commands are shown without sudo, like this one:

docker ps

On Ubuntu, the binary is called docker.io. It also does not work without sudo:

sudo docker.io ps

How can I configure Docker so that I don't need to prefix every Docker command with sudo?

  • 1
    Don't forget to enable ufw ;) – Rinzwind Jun 6 '14 at 8:29
  • 1
    On Ubuntu 14.04 there is also 'docker' binary. – anatoly techtonik Sep 7 '14 at 8:55
  • @anatolytechtonik I also used 'docker' instead of 'docker.io' in Ubuntu 14.04 LTS – Nabin Jul 28 '16 at 1:49
  • 1
    Recommended installation is not the docker in default ubuntu repos; instead, instructions here ( docs.docker.com/engine/installation/linux/ubuntulinux ), recommend using the docker repo. Remove all the existing docker stuff, and verify you're getting the one from the right source: apt-cache policy docker-engine (apt url should be from dockerproject.org) – michael Sep 24 '16 at 6:30
  • How about an alias:? That way, you still use sudo, with password protection. alias docker="sudo docker " – Andrej Panjkov Mar 22 at 17:34
up vote 996 down vote accepted
+100

The docker manual has this to say about it:

Giving non-root access

The docker daemon always runs as the root user, and since Docker version 0.5.2, the docker daemon binds to a Unix socket instead of a TCP port. By default that Unix socket is owned by the user root, and so, by default, you can access it with sudo.

Starting in version 0.5.3, if you (or your Docker installer) create a Unix group called docker and add users to it, then the docker daemon will make the ownership of the Unix socket read/writable by the docker group when the daemon starts. The docker daemon must always run as the root user, but if you run the docker client as a user in the docker group then you don't need to add sudo to all the client commands. As of 0.9.0, you can specify that a group other than docker should own the Unix socket with the -G option.

Warning: The docker group (or the group specified with -G) is root-equivalent; see Docker Daemon Attack Surface details and this blogpost on Why we don't let non-root users run Docker in CentOS, Fedora, or RHEL (thanks michael-n).


Important to read: post-installation steps for Linux (it also links to Docker Daemon Attack Surface details).

Manage Docker as a non-root user

The docker daemon binds to a Unix socket instead of a TCP port. By default that Unix socket is owned by the user root and other users can only access it using sudo. The docker daemon always runs as the root user.

If you don’t want to use sudo when you use the docker command, create a Unix group called docker and add users to it. When the docker daemon starts, it makes the ownership of the Unix socket read/writable by the docker group.


  • Add the docker group if it doesn't already exist:

    sudo groupadd docker
    
  • Add the connected user "$USER" to the docker group. Change the user name to match your preferred user if you do not want to use your current user:

    sudo gpasswd -a $USER docker
    
  • Either do a newgrp docker or log out/in to activate the changes to groups.

  • You can use

    docker run hello-world
    

    to check if you can run docker without sudo.

  • 3
    Yeah, but every privileged process opens up potential for exploit. Is docker hooking that deep into the operating system to really mandate that level of privileges? – matt Jan 10 '15 at 14:24
  • 3
    newgrp docker didn't work for me, i had to log out. – lolmaus - Andrey Mikhaylov Mar 14 '15 at 19:29
  • 30
    It's worth pointing out that this gives that user unrestricted, non-password protected root access. See details of the vulnerability here – Chris Foster Apr 22 '15 at 20:57
  • 2
    you do NOT need to restart the docker daemon for this change to take place!! just have the user that you just added log out then back in – Tommy Sep 12 '16 at 15:21
  • 2
    if you use docker login, you may find that the .docker folder created in your home folder, belongs to root. thus you would encounter this warning when running docker commands: WARNING: Error loading config file:/home/myuser/.docker/config.json - stat /home/myuser/.docker/config.json: permission denied. I made my user's .docker folder accessible without sudo like so: sudo chgrp -hR docker ~/.docker && sudo chown -R myuser ~/.docker. the chgrp didn't seem to help though, so probably I should only recommend the chown step. – Birchlabs Jul 28 '17 at 11:24

To run docker command without sudo, you need to add your user (who has root privileges) to docker group. For this run following command:

 sudo usermod -aG docker $USER

Now, have the user logout then login again. This solution is well explained here with proper installation process.

  • 12
    after add user to group , run this command: sg group_name -c "bash" – madjardi Apr 9 '16 at 2:12
  • 34
    dont really need to restart the OS. Just logout and log in again. – binW May 17 '16 at 9:50
  • 2
    you do not need to restart the OS for this change to take place! That will bomb all running containers! Just have the user that you just added log out then in. – Tommy Sep 12 '16 at 15:22
  • 4
    How is that command different to "sudo gpasswd -a ${USER} docker" in other answer? If at all... – Ashley Aitken Mar 9 '17 at 15:22
  • 5
    Could you please add the warning given by the docs: " The docker group [...] is root-equivalent", so people have a chance to think about it – Murmel Apr 24 '17 at 21:28

The mechanism by which adding a user to group docker grants permission to run docker is to get access to the socket of docker at /var/run/docker.sock. If the filesystem that contains /var/run has been mounted with ACLs enabled, this can also be achieved via ACLs.

sudo setfacl -m user:username:rw /var/run/docker.sock

I'm only including this for completeness.

In general, I recommend to avoid ACLs whenever a good alternative based on groups is available: It is better if the privileges in a system can be understood by looking at group memberships only. Having to scan the file system for ACL entries in order to understand system privileges is an additional burden for security audits.

Warning 1: This has the same root equivalence as adding username to the docker group. You can still start a container in a way that has root access to the host filesystem.

Warning 2: ACLs are significantly more difficult for security audits than group-based security. Probably avoid ACLs if possible when you can use groups instead, at least in audit-relevant environments.

  • 4
    It worked on 16.04 – edib Dec 12 '17 at 8:22
  • This is what I needed, other answers, require the user to have root permission. Thanks do much! – Mrinal Saurabh Feb 13 at 5:24
  • 1
    Much better way imo. The group docker is root-equivalent and that is always a sign of danger. And I don't see any disadvantage to taking ownership of this one file. – Xerus Mar 3 at 0:54
  • Could you describe which commands should be executed in order to "get access to the socket of docker at /var/run/docker.sock"? – Yuval Atzmon Apr 12 at 16:46
  • 3
    @Xerus if I understand correctly, whoever can write to this socket can get root-equivalent privileges too. So giving someone access to this socket via ACL has the same security effect as adding that person to the docker group. – Paŭlo Ebermann Apr 23 at 15:26

protected by Community Dec 7 '14 at 8:04

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.