Is there a good and secure way to allow non-root user to start a docker image?

Question

I have a scenario where I want to let non-root users start a docker image and run it. It's a very simple image - we have a stupid proprietary piece of software that insists on blocking a certain port, making concurrent runs of that software impossible. I was thinking to fix that with docker.

Problem is that normal users (it's a part of a compile process) should be able to spin this up. How do I go about that in a sane and secure fashion?

Answer 1

If the desired docker command is static, create a simple start script, store in in /usr/local/bin and make it executeable. Make an entry in /etc/sudoers to allow desired users to run this command with sudo without a password.

E.g create file /usr/local/bin/alpine.docker:

#! /bin/sh
docker run --rm -it alpine sh

Make the script secure (non root user should not be able to edit it):

sudo chown root:root /usr/local/bin/alpine.docker

Set reasonable permissions and make it executeable:

sudo chmod 554 /usr/local/bin/alpine.docker

Create an entry in /etc/sudoers with visudo:

username  ALL = (root) NOPASSWD: /usr/local/bin/alpine.docker

Now the user username can run sudo alpine.docker without a password.

---

Warning:

Don't add users to group docker if they should not have root privileges.

Note:

For this solution, you need to install sudo. But the user username does not need to be member of group sudo.

Note 2:

A similar setup is possible with policykit / pkexec. But I am not familar with it.