Running Docker Images without Root Access on Managed Linux Servers

Running Docker Images without Root Access on Managed Linux Servers

In many managed Linux server environments, system administrators are hesitant to grant root access to users due to security concerns. This can make it challenging to run Docker images, as the Docker daemon typically requires root privileges. However, there are ways to run Docker images without root access, which we will explore in this article.

Using sudo

One way to run Docker commands without root access is to use the sudo command. By default, the Docker group is added to the sudoers file, which allows members of the group to run Docker commands without requiring a password. Therefore, if a user is added to the Docker group, they can run Docker commands using sudo.

sudo usermod -aG docker 

Once the user has been added to the Docker group, they can run Docker commands using sudo, like so:

sudo docker run -it ubuntu bash

Using Docker without the Docker daemon

Another way to run Docker images without root access is to use a tool like docker-credential-helpers to manage Docker credentials. This allows users to run Docker commands without requiring access to the Docker daemon.

To use docker-credential-helpers, first install the package using your package manager. For example, on Ubuntu, you can install it using the following command:

sudo apt-get install -y docker-credential-helpers

Next, configure Docker to use the credential helper. This can be done by adding the following line to your ~/.docker/config.json file:

{
  "credsStore": "docker-credential-secretservice"
}

Once this is configured, you can run Docker commands without requiring root access. For example:

docker run -it ubuntu bash

Using a dedicated Docker host

Another option is to use a dedicated Docker host that is accessible over the network. This allows users to run Docker commands without requiring root access on the host machine.

To set up a dedicated Docker host, first install Docker on a separate machine. Then, configure the Docker daemon to listen on a network interface that is accessible from the managed Linux server. Finally, configure the firewall to allow traffic to the Docker daemon.

Once this is set up, users can connect to the Docker host using the docker -H option. For example:

docker -H  run -it ubuntu bash

• Running Docker images without root access on managed Linux servers is possible using various methods.
• Using sudo is one way to run Docker commands without root access, by adding the user to the Docker group.
• Using docker-credential-helpers is another way to run Docker commands without requiring access to the Docker daemon.
• Using a dedicated Docker host is another option, which allows users to connect to the Docker daemon over the network.

References

• Install Docker on Linux
• docker usermod
• docker run
• docker credential helpers
• Docker Security: Rootless mode