Is there a way to give access for a user (www-data to be exact) to access ONLY 'docker inspect'? Any working solution is acceptable
2 Answers
You can define this with sudoers(visudo command for editing):
www-data ALL=(ALL:ALL) NOPASSWD:/usr/bin/docker inspect *
www-data user will have access to /usr/bin/docker binary with argument inspect and other arguments to this command. This command won't require password. If you don't want this behaviour remote "NOPASSWD:".
For example:
User can successfully run sudo docker inspect {{container_name}}
User can successfully run sudo docker inspect --help
User can't successfully run sudo docker run {{container}}
User can't successfully run sudo docker inspect without arguments
-
no, I need not to give access to docker binary, but ONLY to 'docker inspect' - e.g. with this argument– TerionAug 19, 2015 at 16:32
-
What do you mean by 'ONLY docker inspect'? Have you tried my configuration for sudoers? It will provide access to docker inspect, but you can't run docker. I can elaborate in skype if you want.– NavernAug 19, 2015 at 17:02
-
-
-
yes, that's I need, thank you) I'll test it out and write about the results– TerionAug 19, 2015 at 17:12
Docker doesn't have any granularity of access permission, but you could write an alternative client quite easily that uses the Docker API to implement just the part you need.
That client could then be setuid to a user with permissions to the Docker socket.
