3

I have on my ubuntu instance a group of non-sudoers ("deploy" group). In order, to enable them to use docker I have to change the permission of "/var/run/docker.sock" file to chgrp deploy /var/run/docker.sock and chmod 770 /var/run/docker.sock.

Is this approach considered as security blunder, is there any other better approach?

1
  • You might be interested in a container engine that allows to run rootless containers, such as Podman. This way users can start containers without having either sudo rights or having a wildly opened docker socket which is not a good idea as described by @vidarlo.
    – dotcs
    Jun 6, 2020 at 19:46

1 Answer 1

3

If you have a look at /var/run/docker.sock, you'll see that it's owned by root UID, and docker gid.

# ls -la /var/run/docker.sock 
srw-rw---- 1 root docker 0 Jun  2 11:37 /var/run/docker.sock

Changing group ownership to your own group may stop docker from working properly, as it relies on the docker group for other functions.

The proper way to handle this is to add your users to the docker group. This is detailed in the post-install documentation. Note that giving a user access to docker is more or less equivalent with making that user root. If you have docker access, becoming root is extremely trivial:

First of all, only trusted users should be allowed to control your Docker daemon. This is a direct consequence of some powerful Docker features. Specifically, Docker allows you to share a directory between the Docker host and a guest container; and it allows you to do so without limiting the access rights of the container. This means that you can start a container where the /host directory is the / directory on your host; and the container can alter your host filesystem without any restriction.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.