Is there a way to give access for a user (www-data to be exact) to access ONLY 'docker inspect'? Any working solution is acceptable


You can define this with sudoers(visudo command for editing):

www-data ALL=(ALL:ALL) NOPASSWD:/usr/bin/docker inspect *

www-data user will have access to /usr/bin/docker binary with argument inspect and other arguments to this command. This command won't require password. If you don't want this behaviour remote "NOPASSWD:".

For example:

User can successfully run sudo docker inspect {{container_name}}
User can successfully run sudo docker inspect --help
User can't successfully run sudo docker run {{container}}
User can't successfully run sudo docker inspect without arguments
| improve this answer | |
  • no, I need not to give access to docker binary, but ONLY to 'docker inspect' - e.g. with this argument – Terion Aug 19 '15 at 16:32
  • What do you mean by 'ONLY docker inspect'? Have you tried my configuration for sudoers? It will provide access to docker inspect, but you can't run docker. I can elaborate in skype if you want. – Navern Aug 19 '15 at 17:02
  • oh, sorry, misread your comment. I'll try, thank you – Terion Aug 19 '15 at 17:03
  • I have edited my answer with examples. Is it what you want? – Navern Aug 19 '15 at 17:06
  • yes, that's I need, thank you) I'll test it out and write about the results – Terion Aug 19 '15 at 17:12

Docker doesn't have any granularity of access permission, but you could write an alternative client quite easily that uses the Docker API to implement just the part you need.

That client could then be setuid to a user with permissions to the Docker socket.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.