linux - 在 Ubuntu Docker 容器中运行非 root Docker

Question

我正在尝试在基于 Ubuntu 20.04 的 Docker 容器中运行 Docker 构建。在 Docker 构建发生之前，容器需要作为构建过程的非 root 用户运行。
这是我的 Dockerfile 的一些片段，以显示我在做什么:

FROM amd64/ubuntu:20.04

# Install required packages
RUN apt-get update && apt-get install -y software-properties-common
                                        build-essential \
                                        libssl-dev \
                                        openssl \
                                        libsqlite3-dev \
                                        libtool \
                                        wget \
                                        autoconf \
                                        automake \
                                        git \
                                        make \
                                        pkg-config \
                                        cmake \
                                        doxygen \
                                        graphviz \
                                        docker.io

# Add user for CI purposes
RUN useradd -ms /bin/bash ciuser
RUN passwd -d ciuser

# Set docker group membership
RUN usermod -aG docker ciuser

# Run bash as the non-root user
CMD ["su", "-", "ciuser", "/bin/bash"]

当我运行容器并尝试运行 docker 命令时，出现错误:

$ docker run -ti --privileged=true -v /var/run/docker.sock:/var/run/docker.sock ci_container_staging
ciuser@0bb768506106:~$ docker ps
Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get http://%2Fvar%2Frun%2Fdocker.sock/v1.40/containers/json: dial unix /var/run/docker.sock: connect: permission denied

如果我删除运行为 ciuser它工作正常:

$ docker run -ti --privileged=true -v /var/run/docker.sock:/var/run/docker.sock /ci_container_staging
root@d71654581cec:/# docker ps
CONTAINER ID        IMAGE                                                  COMMAND             CREATED             STATUS              PORTS               NAMES
d71654581cec        ci_container_staging   "/bin/bash"         3 seconds ago       Up 2 seconds                            vigilant_lalande
root@d71654581cec:/#

通过 Dockerfile 设置 Docker 然后将用户设置为运行身份，我在哪里出错了？

Answer 1

amd64/ubuntu:20.04有一个 docker组 id 为 103 的组。很可能本地机器的 docker 组的 gid 不是 103(检查 getent group docker )。所以即使 ciuser是 docker 的一部分组，id 不同，因此用户无权访问 docker 套接字。
一个简单的解决方法是更改​​ docker 的 gid容器中的组以匹配您的主机:

RUN groupmod -g <HOST_DOCKER_GROUP_ID> docker

还有很多其他方法可以解决将 uid/gid 映射到 docker 容器的问题，但这应该可以为您提供足够的信息来继续前进。
示例/更多信息:

# gid on docker socket is 998
root@c349e1d13b76:/# ls -al /var/run/docker.sock 
srw-rw---- 1 root 998 0 Apr 12 14:54 /var/run/docker.sock

# But gid of docker group is 103
root@c349e1d13b76:/# getent group docker
docker:x:103:ciuser

# root can `docker ps`
root@c349e1d13b76:/# docker ps
CONTAINER ID   IMAGE            COMMAND       CREATED              STATUS              PORTS     NAMES
c349e1d13b76   nonroot:latest   "/bin/bash"   About a minute ago   Up About a minute             kind_satoshi

# but fails for ciuser
root@c349e1d13b76:/# runuser -l ciuser -c 'docker ps'
Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get http://%2Fvar%2Frun%2Fdocker.sock/v1.24/containers/json: dial unix /var/run/docker.sock: connect: permission denied

# change docker gid in the container to match the one on the socket/localhost
# 998 is the docker gid on my machine, yours may (will) be different.
root@c349e1d13b76:/# groupmod -g 998 docker

# run `docker ps` again as ciuser, works.
root@c349e1d13b76:/# runuser -l ciuser -c 'docker ps'
CONTAINER ID   IMAGE            COMMAND       CREATED              STATUS              PORTS     NAMES
c349e1d13b76   nonroot:latest   "/bin/bash"   About a minute ago   Up About a minute             kind_satoshi