docker - docker命令不适用于特定用户

Question

我正在尝试为两个不同的用户执行“docker run hello-world”命令。对于“ec2-user”来说效果很好

ec2-user@ip-172-31-17-83 ~]$ docker run hello-world

Hello from Docker!
This message shows that your installation appears to be working correctly.

To generate this message, Docker took the following steps:
 1. The Docker client contacted the Docker daemon.
 2. The Docker daemon pulled the "hello-world" image from the Docker Hub.
    (amd64)
 3. The Docker daemon created a new container from that image which runs the
    executable that produces the output you are currently reading.
 4. The Docker daemon streamed that output to the Docker client, which sent it
    to your terminal.

To try something more ambitious, you can run an Ubuntu container with:
 $ docker run -it ubuntu bash

Share images, automate workflows, and more with a free Docker ID:
 https://hub.docker.com/

For more examples and ideas, visit:
 https://docs.docker.com/get-started/

但不适用于“gitlab-runner”用户

[ec2-user@ip-172-31-17-83 ~]$ sudo docker run hello-world --user=gitlab-runner
docker: Error response from daemon: OCI runtime create failed: container_linux.go:348: starting container process caused "exec: \"--user=gitlab-runner\": executable file not found in $PATH": unknown.

可能是什么原因？

gitlab-runner的$ PATH

[ec2-user@ip-172-31-17-83 ~]$ echo $PATH --user=gitlab-runner /usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin:/opt/aws/bin:/home/ec2-user/.local/bin:/home/ec2-user/bin --user=gitlab-runner [ec2-user@ip-172-31-17-83 ~]$ whereis docker docker: /usr/bin/docker /etc/docker /usr/share/man/man1/docker.1.gz [ec2-user@ip-172-31-17-83 ~]$

Answer 1

镜像名称之后的任何内容都将解释为要运行的命令:

sudo docker run \
  hello-world \           # image name
  --user=gitlab-runner    # command to run inside the container

如果您有 docker run的任何选项，则它们必须在图像名称之前

sudo docker run \
  --user=gitlab-runner \  # set the user based off the container's /etc/passwd
  hello-world             # image name
                          # running the default command