How to grant fine-grained privileges to non-root users in Docker

Introduction

Docker is a powerful containerization platform that has revolutionized the way applications are developed, deployed, and managed. However, running Docker containers as the root user can pose security risks. This tutorial will guide you through the process of granting fine-grained privileges to non-root users in Docker, empowering them to perform specific tasks without compromising the overall system security.

Understanding Docker User Privileges

Docker containers are designed to run as non-privileged users by default, which helps to improve the overall security of the system. However, there may be scenarios where you need to grant fine-grained permissions to non-root users within a Docker container to perform specific tasks.

Default User Privileges in Docker

By default, Docker containers run as the root user, which has the highest level of privileges within the container. This can be a security risk, as any vulnerabilities or malicious activities within the container could potentially affect the host system.

To mitigate this risk, Docker recommends running containers as non-root users. You can do this by specifying a user in the Dockerfile or by using the --user flag when running a container.

## Dockerfile
FROM ubuntu:22.04
RUN useradd -ms /bin/bash myuser
USER myuser

## Run container as non-root user
docker run -it --user myuser ubuntu:22.04 bash

Understanding User Namespaces

Docker uses user namespaces to provide an additional layer of isolation and security for non-root users within a container. User namespaces allow you to map a user and group IDs from the container to different IDs on the host system, effectively creating a separate user space for the container.

graph TD A[Host System] --> B[Container] B[Container] --> C[Mapped User ID] B[Container] --> D[Mapped Group ID]

This mapping ensures that even if a non-root user within the container has high privileges, they cannot affect the host system or other containers running on the same host.

Verifying User Privileges

You can use the id command within the container to verify the user and group IDs that the current user has been mapped to:

$ id
uid=1000(myuser) gid=1000(myuser) groups=1000(myuser),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),113(lxd),128(systemd-journal),129(systemd-journal-gateway)

This output shows that the myuser user has been mapped to a user ID of 1000 and a group ID of 1000 within the container.

Assigning Fine-Grained Permissions to Non-Root Users

While running containers as non-root users is a good security practice, there may be cases where you need to grant specific permissions to these users to perform certain tasks. Docker provides several ways to assign fine-grained permissions to non-root users within a container.

Using the `--cap-add` and `--cap-drop` Flags

Docker supports the use of Linux capabilities, which allow you to grant or revoke specific privileges to a user or process. You can use the --cap-add and --cap-drop flags when running a container to add or remove capabilities for the non-root user.

## Grant the "CAP_SYS_ADMIN" capability to the non-root user
docker run -it --user myuser --cap-add=SYS_ADMIN ubuntu:22.04 bash

## Remove the "CAP_CHOWN" capability from the non-root user
docker run -it --user myuser --cap-drop=CHOWN ubuntu:22.04 bash

Mounting Volumes with Specific Permissions

You can also grant fine-grained permissions to non-root users by mounting volumes with specific ownership and permissions. This allows you to control the access rights of the non-root user within the container.

## Mount a volume with specific permissions
docker run -it --user myuser -v /path/on/host:/path/in/container:rw,uid=1000,gid=1000 ubuntu:22.04 bash

In this example, the mounted volume is accessible by the non-root user with a user ID of 1000 and a group ID of 1000.

Using the `--group-add` Flag

If the non-root user needs to perform tasks that require membership in specific groups, you can use the --group-add flag to add the user to additional groups within the container.

## Add the non-root user to the "docker" group
docker run -it --user myuser --group-add docker ubuntu:22.04 bash

This allows the non-root user to perform tasks that require the "docker" group membership, such as interacting with the Docker daemon.

Customizing the `Dockerfile`

You can also customize the Dockerfile to create a non-root user with specific permissions and group memberships. This ensures that the non-root user has the necessary privileges to perform their tasks within the container.

## Dockerfile
FROM ubuntu:22.04
RUN useradd -ms /bin/bash myuser
RUN usermod -aG docker myuser
USER myuser

This Dockerfile creates a non-root user named myuser and adds them to the "docker" group, allowing them to interact with the Docker daemon.

Practical Use Cases and Examples

Assigning fine-grained permissions to non-root users in Docker can be beneficial in a variety of scenarios. Here are some practical use cases and examples:

Scenario 1: Running a Web Server

Suppose you have a web application running in a Docker container, and you want the non-root user to have the necessary permissions to start and manage the web server process.

## Dockerfile
FROM ubuntu:22.04
RUN useradd -ms /bin/bash myuser
RUN apt-get update && apt-get install -y nginx
RUN chown -R myuser:myuser /var/www/html
USER myuser
CMD ["nginx", "-g", "daemon off;"]

In this example, the myuser non-root user is granted ownership of the /var/www/html directory, which is the default location for the Nginx web server. This allows the non-root user to start and manage the Nginx process within the container.

Scenario 2: Accessing Sensitive Files

If your container needs to access sensitive files or directories, you can grant the non-root user the necessary permissions to read or write to those locations.

## Run container with specific volume permissions
docker run -it --user myuser -v /path/to/sensitive/files:/sensitive:rw,uid=1000,gid=1000 ubuntu:22.04 bash

In this example, the non-root user with a user ID of 1000 and a group ID of 1000 is granted read and write access to the /path/to/sensitive/files directory within the container.

Scenario 3: Interacting with the Docker Daemon

If your non-root user needs to interact with the Docker daemon, you can add them to the "docker" group within the container.

## Dockerfile
FROM ubuntu:22.04
RUN useradd -ms /bin/bash myuser
RUN usermod -aG docker myuser
USER myuser

This Dockerfile creates a non-root user named myuser and adds them to the "docker" group, allowing them to perform Docker-related tasks, such as building and managing containers.

Scenario 4: Executing Privileged Commands

In some cases, your non-root user may need to execute privileged commands that require specific capabilities. You can use the --cap-add flag to grant the necessary capabilities to the non-root user.

## Run container with specific capability
docker run -it --user myuser --cap-add=SYS_ADMIN ubuntu:22.04 bash

In this example, the non-root user is granted the "CAP_SYS_ADMIN" capability, which allows them to perform system administration tasks that require elevated privileges.

By understanding these practical use cases and examples, you can effectively grant fine-grained permissions to non-root users in Docker, ensuring that they have the necessary access to perform their tasks while maintaining a secure and isolated environment.

Summary

In this comprehensive Docker tutorial, you will learn how to assign granular permissions to non-root users, enabling them to interact with Docker containers and resources without escalating their privileges. By understanding the principles of user privileges in Docker and exploring practical use cases, you will be able to implement a more secure and efficient Docker environment tailored to your organization's needs.