3

We would like to use docker on the servers of our university. From reading

https://docs.docker.com/install/linux/linux-postinstall/#manage-docker-as-a-non-root-user

I understand that it is recommended to create a Unix group docker and add users to this group. In my research group we share one server machine, so naturally I would add several people to the docker group.

But does this also mean every member of the docker group can, among other things, start and stop any container, even if the containers are not their own? To me this seems to be impractical.

More generally, my question is:

What are best practices for teams to use docker on a shared machine?

3
  • 1
    I wouldn't do that at all. I'd skip directly to something orchestrated with multitenant functionality, such as OpenShift. Sep 12, 2019 at 16:29
  • using openshift/kubernetes you have more control on users.
    – c4f4t0r
    Sep 12, 2019 at 18:24
  • OpenShift and Kubernetes are probably a little overly complicated for a single server. For a quick and dirty container management tool, I’d suggest using Portainer. It has some level of user isolation, but is dead simple to use.
    – GregL
    Sep 13, 2019 at 0:28

1 Answer 1

4

TL;DR: docker group membership = root rights

The docker group

It is true that is an often read advice to add users which should be able to use docker to the docker group. However, as users are root inside containers and can mount any path on the system by using -v (even the paths they do not normally have access to), this is effectively giving all users root rights.

It is thus only to be considered a "minor" concern that the users can mess with other users' containers. They can actually do anything with the system if they are members of the docker group.

Docker on a shared machine

If it really needs to be the original Docker, consider two options:

1. The stable solution: Docker in VM

What I am doing all the time is running Docker inside virtual machines. You add one virtual machine per user to the shared machine and then allow the users to run containers within that machine. Of course, this only works if you can tolerate the resource overhead (and with many users of which only few are logged in at the time, it might be necessary to develop some scheme to start and stop VMs automatically).

2. The experimental solution: Rootless Docker

I do not know the current state of the project but there is work on making Docker available without root s.t. a user can just run their own Docker (without needing any group memberships). See https://engineering.docker.com/2019/02/experimenting-with-rootless-docker/

Another solution: Alternative to Docker.

In case it need not be Docker but any container environment, consider the alternatives. I have read that podman offers a very similar interface without the need for running it as root.

1
  • Thanks for accepting my answer :) I am using Docker in such environments myself and would thus of course also be interested which solution was chosen in the end and if it worked for the purpose?
    – linux-fan
    Oct 31, 2019 at 14:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .