I need to give low-level users access to various Jenkins jobs and I want to run Jenkins as a Docker container on my hosts.

I understand that if a user (through sudo or whatever) can access the Docker daemon then I am effectively giving up superuser access on my hosts due to Docker's capabilities (mounting the root filesystem etc).

What is the best way to protect my Docker daemons from Jenkins? The jobs need to be able to start containers etc.

Does Docker 1.10 address this?

  • This well-quoted post by Dan Walsh unfortunately doesn't help this problem: projectatomic.io/blog/2015/08/… – Thinkpad Dec 1 '16 at 11:34
  • The bottom line is, if you have access to the Docker daemon, you are root. – johnharris85 Dec 5 '16 at 0:04
  • @Thinkpad Could you indicate why unfortunately doesn't help this problem – 030 Apr 23 '17 at 16:50

This documentation indicates that:

As of Docker 1.10 User Namespaces are supported directly by the docker daemon. This feature allows for the root user in a container to be mapped to a non uid-0 user outside the container, which can help to mitigate the risks of container breakout. This facility is available but not enabled by default.

Refer to the daemon command in the command line reference for more information on this feature. Additional information on the implementation of User Namespaces in Docker can be found in this blog post.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.