CODEWITHSUNDEEP
docker
bolind
bolind

Reputation: 530

Is there a good and secure way to allow non-root user to start a docker image?

I have a scenario where I want to let non-root users start a docker image and run it. It's a very simple image - we have a stupid proprietary piece of software that insists on blocking a certain port, making concurrent runs of that software impossible. I was thinking to fix that with docker.

Problem is that normal users (it's a part of a compile process) should be able to spin this up. How do I go about that in a sane and secure fashion?

Upvotes: 4

Views: 1751

Answers (3)

mviereck
mviereck

Reputation: 1399

If the desired docker command is static, create a simple start script, store in in /usr/local/bin and make it executeable. Make an entry in /etc/sudoers to allow desired users to run this command with sudo without a password.

E.g create file /usr/local/bin/alpine.docker:

#! /bin/sh
docker run --rm -it alpine sh

Make the script secure (non root user should not be able to edit it):

sudo chown root:root /usr/local/bin/alpine.docker

Set reasonable permissions and make it executeable:

sudo chmod 554 /usr/local/bin/alpine.docker

Create an entry in /etc/sudoers with visudo:

username  ALL = (root) NOPASSWD: /usr/local/bin/alpine.docker

Now the user username can run sudo alpine.docker without a password.

Warning:

Don't add users to group docker if they should not have root privileges.

Note:

For this solution, you need to install sudo. But the user username does not need to be member of group sudo.

Note 2:

A similar setup is possible with policykit / pkexec. But I am not familar with it.

Upvotes: 4

emory
emory

Reputation: 10891

I prefer https://stackoverflow.com/a/50876910/348975 solution, but an alternative is to use something like docker machine https://stackoverflow.com/a/50876910/348975 or dind https://hub.docker.com/_/docker/ to create a brand new throwaway docker.

Then you set the environment variable export DOCKER_HOST=tcp://${IP_ADDRESS}:2376 and can use that docker without root.

This is probably not necessary for OPs case, but where it would come in handy is if the image had to be run with arbitrary privileges:

docker container run --privileged ...

Can you escalate from --privileged to root? I don't know you can not. I would rather assume you can and isolate the docker.

Since OP has one simple static predetermined docker command that OP is confident can not be escalated, I feel https://stackoverflow.com/a/50876910/348975 is the preferred solution.

If you are paranoid, you can use both https://stackoverflow.com/a/50876910/348975 and my solution together.

Upvotes: 0

Rohan J Mohite
Rohan J Mohite

Reputation: 2613

Create the docker group and add your user to the docker group.

$ sudo groupadd docker
$ sudo usermod -aG docker $USER

Log out and log back in so that your group membership is re-evaluated.

You can follow docker documentation for more details manage-docker-as-a-non-root-user

Upvotes: -1

Related Questions