Add main user account to docker group

Question

I recently installed ubuntu on my home system. As I am going to mainly use it for machine learning research, I tried to set up a python environment. I tried doing this with docker to make things easier (interference with the pre-installed python), but I ran into some instructions that said to add the current user to a docker user group, making it roughly equivalent to a root user. Not knowing much about this subject, I want to ask, is doing this a big risk for a desktop that will only be used at home? The docker website itself does warn about some risks, but I'd like to know if this applies to my scenario.

Answer 1

So for a standard desktop system where you don't have multiple users, adding your own user to the docker group may not be a major risk, depending on your risk appetite and what you use the machine for. It's roughly equivalent to having sudo access without a password set.

Essentially it would mean that if an attacker had already gained access to your machine as your ordinary user account, they would then be able to gain access as the root user to that system.

Answer 2

Docker daemon run with root privileges, but containers running inside it, even those that you don't set the current user (USER command in your Dockerfile) will run with limited access.

You can also drop some capabilities to isolate those containers reducing the attack surface. And never run untrusted containers with the privileged.

If a container is running with root (inside the container), and you map some volume, it will have access as root. So this is another point to avoid.

Here an example docker run --rm -it -v '/:/mnt' debian:9.2 cat /mnt/etc/shadow, it will have full access to / as root, it means, it can infect binaries, have access to your /etc/shadow file, add/remove/change password of users, etc...

Here is the full reference: https://docs.docker.com/engine/security/security/#conclusions