Based on the documentation here https://docs.docker.com/engine/security/, it does not seem that there are any built-in features to restrict the current logged-in user to run certain Docker commands.

For example, I'd only want to allow a user to build images instead of running them. Hence, I'd want to allow 'docker build' instead of 'docker run'. If this is performed on DIND (Docker in Docker) without Kubernetes RBAC, how can this security be achieved?

  • I did a bit of research. I came across Twistlock Authz which could potentially be run before hand (say in a DockerFile) to restrict what the user could run. Does this mitigate the risk? github.com/twistlock/authz Sep 22, 2022 at 15:09

1 Answer 1


Generally speaking Docker is an "all or nothing" proposition from an authorization perspective. An authenticated user (through having access to the docker socket file or TCP port, if it's listening on the network) gets full access to docker and as a result root access to the underlying host.

Docker does provide an authorization plugin framework, but I've not seen many actual implementations. Depending on your needs one option would be to provide users with a limited web front end to deploy containers to hosts and then provide the access to the Docker daemon to that web front end.

Tools like Portainer have some RBAC capabilities here that might be useful.

Docker's really more of a development tool than a production tool. For that people tend to use container orchestration tools or make all changes via a CI/CD system and place access control in that system.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .