How can I manage docker group in freeipa?

Question

First I tried managing dockerroot in freeipa, since that is the only one I saw with sudo getent group | grep dock.

I saw somewhere that said I can create a group in freeipa with the same GID and it will sync with the local group.

That is not an option for me. I have the group dockerroot on several machines with different GIDs.

So I turned to sss_override.

I tried sudo sss_override group-add dockerroot -g <my_freeipa_gid> but I get:

Unable to find group dockerroot@[unknown].

I can't find in the documentation if I am missing something. I tried using dockerroot@localhost but I get:

Unable to parse name dockerroot@localhost.

I started deploying docker to machines and want a couple users to be able to run docker without sudo. I don't want to create rules on every target machine. Any time I spin up a new machine with docker, special users should automatically get the group membership through freeipa rules.

Doing yum remove docker && yum install docker doesn't seem to affect the group either.

Could I just delete it and recreate it? I don't know what I'm breaking here so I'm hesitant to do more.

---

Now I've tried following docker's docs which say to do this:

sudo groupadd docker
sudo usermod -aG docker $USER
docker run hello-world

I want this on my domain so instead I create the group in freeipa, and add my user to it. I gave it time to sync, logged out and in, and checked the group:

sudo getent group docker
docker:*:<my_freeipa_id>:<my_uid>

But I still get permission denied.

Answer 1

Since you have the group dockerroot, I am assuming you are using the RedHat/CentOS provided Docker packages.

I believe the issue is that RedHat does not ship Docker to be used by groups by default. To verify, check the permissions of the socket file (default location /var/run/docker.sock).

You would need to change the Docker configuration (default /etc/docker/daemon.json) to create the Docker socket with the group permissions you wish to use. You can use any group, as long as the socket file is created with the desired group permissions. Official documentation for the daemon.json config file

This Bugzilla ticket has a statement about why the default permissions do not allow non-root groups to run Docker