How to invoke docker container within docker without root? - docker

Question

I know there are solutions using docker in docker (docker/dind), but seems there are people giving reasons not to use it, but rather expose the socket to the first docker container by adding option:
--volume /var/run/docker.sock:/var/run/docker.sock
I am a docker user on a server (in docker user group), and I am able to run docker container with above option, but once I am in the docker container, when I want to invoke another docker container by: docker run image_name, I got error:
dial unix /var/run/docker.sock: connect: permission denied
I know this error is expected, as the user in my invoked docker container is not in the group docker of the host, I saw people provide solution by adding USER root to the docker file. Since I don't have sudo access to the server, I just wonder if there is a way to enable invoking docker in docker with out root?
Many thanks!

Answer 1

On the docker host, do not change the file permissions on the docker.sock to anything like 777. Doing so would expose a security risk that anyone on the host, including every untrusted user, with a command like:
docker run -it --rm -v /:/host busybox sh
To access the docker socket from inside of a container, you'll want to either run your container as root, e.g.:
docker run -it --rm -u "0:0" -v /var/run/docker.sock:/var/run/docker.sock docker docker version
Or you can run your container with the docker gid inside the container:
docker run -it --rm -u "1000:$(getent group docker | cut -f3 -d:)" -v /var/run/docker.sock:/var/run/docker.sock docker docker version
In production, you would make all the docker hosts with a predictable GID on the docker group on each host, and add your container user inside the image with that GID. That would be part of your Dockerfile with something like:
ARG DOCKER_GID=999
RUN useradd -u 5000 -g $DOCKER_GID app
USER app
My preferred solution for portable environments, particularly development environments, is to start the container as root, and dynamically adjust the group id inside the container to match the file gid of a volume mount. For an example of this, there's a fix-perms script in my docker-base repo that can be run in an entrypoint. The fix-perms script contains code like:
# update the gid
if [ -n "$opt_g" ]; then
OLD_GID=$(getent group "${opt_g}" | cut -f3 -d:)
NEW_GID=$(stat -c "%g" "$1")
if [ "$OLD_GID" != "$NEW_GID" ]; then
echo "Changing GID of $opt_g from $OLD_GID to $NEW_GID"
groupmod -g "$NEW_GID" -o "$opt_g"
if [ -n "$opt_r" ]; then
find / -xdev -group "$OLD_GID" -exec chgrp -h "$opt_g" {} \;
fi
fi
fi
And then an entrypoint would check for being root before fixing the permissions, and then drop to running as a non-root user, e.g.:
if [ "$(id -u)" = "0" -a -e /var/run/docker.sock ]; then
fix-perms -r -g docker /var/run/docker.sock
fi
# run process as the container user "app" if currently root
if [ "$(id -u)" = "0" ]; then
exec gosu app "$#"
else
exec "$#"
fi
And by doing this check, the same image can be locked down in the production environment by using a predictable GID on the docker hosts that matches what's inside the image builds. And for all other hosts that didn't control the docker GID it can start the container as root, fix the permissions, and then drop to the app user inside the container.