Docker Sub commands using sudo
One solution is to provide them with selected docker commands using
sudo and do not provide the
docker attach, or
docker run command.
You can restrict them to run only
Please see the documentation or man page of
sudo for how to provide only the subcommands that you want to allow to users. Providing docker access using
sudo is the recommended method anyway, instead of putting users in a docker group straight away.
visudo or create a file under
/etc/sudoers.d/<username> and create a line for each command you need to allow: ( this is kind of rough , in production I suppose you will be managing sudo config using some config management tool like
ansible that will do this for you once you write the config code )
<user_account> ALL=(root) NOPASSWD: /usr/bin/docker ps
Note: I had such a use case where an automated bot user needed only the docker pull command so I just restricted that account to run docker pull only through sudo. This approach makes sure: