0

My task is provide access to particular docker container without adding user to docker group.

What I did

1) Made a nsenter-based script which must enter container (let's call it script1.sh)

#!/bin/bash
PID=$(docker inspect --format {{.State.Pid}} kayako-dashboard)
nsenter --target $PID --mount --uts --ipc --net --pid /bin/sh

2) Make this script globally available sudo ln -s /full/path/to/script1.sh /usr/local/bin/some_new_command

3) Adjusted target ssh key by adding command="some_new_command" before ssh-rsa in authorized_keys file.

But when I log in under target user

sshpass -p <user_password> ssh <target_user>@<docker_host> "some_new_command"

I got an error Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock

What is wrong and is there any way to fix ?

My kernel version is 4.4.0, so it supports entering the pid namespace.

nsenter version: nsenter from util-linux 2.27.1

P.S. Even if I add <target_user to docker group and try to execute some_new_command I got an error: nsenter: cannot open /proc/<PID>/ns/ipc: Permission denied

P.P.S. If I use sudo some_new_command are executing fine.

Paul Serikov
  • 2,550
  • 2
  • 21
  • 36
  • You have 2 problems here actually. 1st is getting PID of process from docker inspect. This itself requires user to be able to run docker commands. 2nd problem is that you try to run nsenter as non root user to access other user process. It works with sudo because then you run all as root. If you need some unprivileged access I would experiment with https://docs.docker.com/engine/api/v1.32/#operation/ContainerAttachWebsocket and create web app that allows access to specific containers. – odk Oct 12 '17 at 18:31
  • Do you want user to just access just this container or host (system)+ this container? – Tarun Lalwani Oct 12 '17 at 21:32
  • @TarunLalwani, just container – Paul Serikov Oct 13 '17 at 07:11
  • See if this helps https://stackoverflow.com/questions/46508679/dockerize-user-sessions/46509952#46509952 – Tarun Lalwani Oct 13 '17 at 08:11

0 Answers0