I am using a CentOS 6.9 system of High performance computation platform and I wanna use docker with non-root user. Is there a method that I can build docker from source and do not need root privilege?
-
1Docker doesn't really work without root. Maybe do the build in a VM where the root user is contained? – Matt Jan 28 '18 at 0:16
-
I suggest singularity (sylabs.io/singularity). Containers need to be built with root, but can run without it. Be careful for any technology: CentOS 6 has old versions of the C library and ld loader. So anything that requires libc > 2.12 won't run without a lot more work (or recompile) – Robert Lugg Nov 4 '19 at 17:56
This shouldn't be possible as it would be a major security concern.
When docker is installed on a machine, users with docker access (not necessarily root) can start containers. In particular, they can start containers in priviliged mode, giving the container access to all host devices.
More importantly, A user with access to docker can mount directories owned exclusively by machine root. Since by default, a root user inside the container will have access to mounted root-owned directories inside the container, this will allow any Docker container started by a non-root user to access critical machine stuff.
Therefore, the sequence of having a non-root user install Docker and start containers should not be allowed as it can compromise the whole machine.
Check this explicit comment from one of the docker maintainers.
-
1
-
-
1Why can't the access denied to non-root users be also be denied to the processes in the container? I feel this is more of an implementation issue rather than a vulnerability. – Varun Garg Jan 28 '19 at 18:39
-
@VarunGarg The default behavior after installing Docker is that the us's uid inside the container maps to the same uid on the host. Thus by default user with uid
0
(root) inside the container maps to root on host machine. To solve this issue, Docker introduced user namespaces(docs.docker.com/engine/security/userns-remap) that map container uids to a different range on host and thus avoiding the mention vulnerability. However, still installing Docker requires privileged access. – yamenk Jan 28 '19 at 20:18
Update to the yamenk's answer:
There is now an official rootless mode for Docker: Run the Docker daemon as a non-root user
Here's an explanation of how it works from one of Docker engineers:
Experimenting with Rootless Docker
-
Thanks for the update! I think a nicer answer would be to summarize your findings and explain exactly what it offers in context of the question (and accepted answer). – wordsmith Sep 29 '20 at 18:59
-