TL;DR: docker
group membership = root rights
The docker
group
It is true that is an often read advice to add users which should be able to use docker to the docker
group. However, as users are root inside containers and can mount any path on the system by using -v
(even the paths they do not normally have access to), this is effectively giving all users root rights.
It is thus only to be considered a "minor" concern that the users can mess with other users' containers. They can actually do anything with the system if they are members of the docker
group.
Docker on a shared machine
If it really needs to be the original Docker, consider two options:
1. The stable solution: Docker in VM
What I am doing all the time is running Docker inside virtual machines. You add one virtual machine per user to the shared machine and then allow the users to run containers within that machine. Of course, this only works if you can tolerate the resource overhead (and with many users of which only few are logged in at the time, it might be necessary to develop some scheme to start and stop VMs automatically).
2. The experimental solution: Rootless Docker
I do not know the current state of the project but there is work on making Docker available without root s.t. a user can just run their own Docker (without needing any group memberships). See https://engineering.docker.com/2019/02/experimenting-with-rootless-docker/
Another solution: Alternative to Docker.
In case it need not be Docker but any container environment, consider the alternatives. I have read that podman
offers a very similar interface without the need for running it as root.