0

Is it possible to set up docker, so that an untrusted user can run a subset of docker commands e.g. exec, start/stop, run. So that a container can be set up as a process server (e.g. compile server), and a user can run jobs on it.

However they can not create new containers, can not write to host system files (or read/write anywhere that they can not read/write as them-self). And not do anything else that could harm the host.

2 Answers 2

1

I think that podman will be more suited for your use-case.

2
  • could you explain that a bit in your answer? I think you might be right, within specific boundary conditions, but it'd be important for ctrl-alt-delor to understand when exactly an unprivileged podman container is better than docker. Commented Dec 31, 2023 at 19:46
  • I have started to look into it. It may be a better option ( And the User Interface looks to be the same). Commented Dec 31, 2023 at 20:40
0

This quote from the Debian Wiki.

Docker group membership is more dangerous than sudo

The Docker documentation say:

First of all, only trusted users should be allowed to control your Docker daemon.

And:

The docker group grants root-level privileges to the user.

Do not add untrusted users to the docker group. Instead, you can allow the rootless mode, the daemon and the container are not running as root but in the user namespace. See Run the Docker daemon as a non-root user (Rootless mode)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .