11

I need to deploy the Docker image, but I only want to use the Docker run command without using any of its arguments.

I want to assign special permission while running the container.

This is my Docker run command:

docker run --cap-add SYS_ADMIN --cap-add DAC_READ_SEARCH ping

But I just want to use only:

docker run ping

What changes should I do in my Docker file? I cannot use Docker Compose (not my usecase).

My Docker file:

My Docker file is

2
  • The Imgur image link is broken (though it may or may not be due to a temporary outage). Use the opportunity to post the text instead. Thanks in advance. Aug 7, 2018 at 21:09
  • @freedev answer below was helpful... Aug 10, 2020 at 17:21

4 Answers 4

16

You can do that with docker-compose.

This works for version 2 and 3. For example:

version: '2'
services:
  myapp:
    cap_add:
    - SYS_ADMIN
    - DAC_READ_SEARCH
2
6

You can't do that. An image can't grant itself elevated privileges to control the system it runs on; only the administrator actually running the docker run can do that.

It's better to wrap this in something like a Docker Compose YAML file or a shell script that includes all of the required docker run arguments.

If you're trying to build a "helper command" via Docker, there's two things worth remembering. One is that everyone who can run Docker commands has unrestricted root privileges over the host; it's very hard to stop someone from docker run -v /:/host -u root ... and getting unrestricted access to the host's filesystem. Another is that there are many Docker options like this (including setting environment variables, volume mounts, and publishing ports) that are set extremely routinely, so it's hard to build an image where just docker run imagename on its own brings up the image with full functionality.

0

Write a script like /usr/local/sbin/docker-ping.sh:

#!/bin/sh

docker run --cap-add SYS_ADMIN --cap-add DAC_READ_SEARCH ping

Then another script, /usr/local/bin/docker-ping:

#!/bin/sh

sudo /usr/local/sbin/docker-ping.sh

And finally modify sudo appropriately.

2
  • What do you mean by modifying sudo? Aug 7, 2018 at 21:11
  • You can configure sudo to only allow the user to run a specific command. The normal configuration would allow the user to run all commands which would allow the user to run arbitrary docker commands. Appropriate sudo configuration would allow the user to only run '/usr/local/sbin/docker-ping.sh'
    – emory
    Aug 9, 2018 at 10:47
0

If exist the docker group into the system, probably you don't need to use sudo command. As described on this link, append the group docker, and add your user to the group. That will avoid to use sudo. I have just tested other privileged commands and they worked without any issue for me. Repeating the steps into the above link:

sudo groupadd docker
sudo usermod -aG docker $USER

The docker daemon should be restarted to make effect the above, or restart the machine.

By the way, the focus of your question, the best option is to launch with a shell script as far as I know. It is good the approach indicated previously, but I would write this other one which allow pass arbitrary parameters and is more generic for any command you could need.

File: privileged-wrapper.sh

#!/bin/bash
IMAGE_NAME="your_image_name"
BINARY="$0"
BINARY="${BINARY#./}"
docker run --cap-add SYS_ADMIN --cap-add DAC_READ_SEARCH --rm "$IMAGE_NAME" "$BINARY" "$@"

And now, you can create so many symbolic links as commands you need for those capabilities (keep in mind that the name of the symbolic link is the command to be launched into the container). It is expected the command to be launched is found into the PATH.

chmod a+x privileged-wrapper.sh
ln -svf privileged-wrapper.sh ping

Finally just launch:

./ping -c 10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.