[Bug 1119282] New: [Regression] Unable to run docker client as non-root user

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1119282

            Bug ID: 1119282
           Summary: [Regression] Unable to run docker client as non-root
                    user
           Product: Fedora
           Version: 19
         Component: docker-io
          Assignee: lsm5(a)switzerlandmail.ch
          Reporter: psavage(a)redhat.com
        QA Contact: extras-qa(a)fedoraproject.org
                CC: admiller(a)redhat.com, golang(a)lists.fedoraproject.org,
                    hushan.jia(a)gmail.com, lsm5(a)switzerlandmail.ch,
                    mattdm(a)redhat.com, mgoldman(a)redhat.com, s(a)shk.io,
                    vbatts(a)redhat.com



Description of problem: Docker used to be able to run it's client as non-root
user, allowed things like `docker ps` and `docker run` but since latest update
I am unable to do that. Even though the user running the docker command is in
the docker group, which previously worked.


Version-Release number of selected component (if
applicable):docker-io-1.0.0-6.fc19.x86_64


How reproducible:


Steps to Reproduce:
1. Run docker ps
2.
3.

Actual results:
2014/07/14 13:25:33 Get http:///var/run/docker.sock/v1.12/containers/json: dial
unix /var/run/docker.sock: permission denied


Expected results:
Docker command should run

Additional info:

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1119282] [Regression] Unable to run docker client as non-root user

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1119282

Marek Goldmann <mgoldman(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|unspecified                 |urgent



--- Comment #1 from Marek Goldmann <mgoldman(a)redhat.com&gt; ---
I'm seeing this too, this helps:

sudo chown root:docker /var/run/docker.sock

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1119282] [Regression] Unable to run docker client as non-root user

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1119282



--- Comment #2 from Marek Goldmann <mgoldman(a)redhat.com&gt; ---
In my case the issue is with docker-io-1.0.0-6.fc20.x86_64 package.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1119282] [Regression] Unable to run docker client as non-root user

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1119282



--- Comment #3 from Pete Savage <psavage(a)redhat.com&gt; ---
Thanks Marek,

The workaround fixed it!

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1119282] [Regression] Unable to run docker client as non-root user

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1119282

Phil <beaaegicfqmq6rykaqaakty3lqcg6btv(a)protected32.unixadm.org&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |beaaegicfqmq6rykaqaakty3lqc
                   |                            |g6btv(a)protected32.unixadm.o
                   |                            |rg



--- Comment #4 from Phil <beaaegicfqmq6rykaqaakty3lqcg6btv(a)protected32.unixadm.org&gt;
---
docker-io changelog shows:

* Tue Jun 24 2014 Lokesh Mandvekar <lsm5(a)fedoraproject.org&gt; - 1.0.0-4
- Set mode,user,group in docker.socket file

file /usr/lib/systemd/system/docker.socket:
SocketUser=root
SocketGroup=docker

On startup, this is what systemd tells us:

systemd[1]: [/usr/lib/systemd/system/docker.socket:7] Unknown lvalue
'SocketUser' in section 'Socket'
systemd[1]: [/usr/lib/systemd/system/docker.socket:8] Unknown lvalue
'SocketGroup' in section 'Socket'

Looks like Lokesh added a systemd feature that isn't available in F20 yet:
https://github.com/systemd/systemd/commit/3900e5fdff688dc3c273f177d9d913b...

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1119282] [Regression] Unable to run docker client as non-root user

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1119282



--- Comment #5 from Lokesh Mandvekar <lsm5(a)switzerlandmail.ch&gt; ---
Hi Phil, the SocketUser and SocketGroup is Re: CVE-2014-3499 Bug 1114810 . Not
certain yet if systemd for f20 has the relevant stuff
http://koji.fedoraproject.org/koji/packageinfo?packageID=10477

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1119282] [Regression] Unable to run docker client as non-root user

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1119282



--- Comment #6 from Phil <beaaegicfqmq6rykaqaakty3lqcg6btv(a)protected32.unixadm.org&gt;
---
Hi Lokesh,

SocketUser and SocketGroup came with systemd 214. F20 ships 208.

Let's see what happens next :)

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1119282] [Regression] Unable to run docker client as non-root user

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1119282

Lokesh Mandvekar <lsm5(a)switzerlandmail.ch&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |zbyszek(a)in.waw.pl



--- Comment #7 from Lokesh Mandvekar <lsm5(a)switzerlandmail.ch&gt; ---
Zbigniew, could you please update systemd for f20, perhaps f19 too.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1119282] [Regression] Unable to run docker client as non-root user

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1119282

Lars Kellogg-Stedman <lars(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |lars(a)redhat.com



--- Comment #8 from Lars Kellogg-Stedman <lars(a)redhat.com&gt; ---
Note that you can work around this issue in Fedora 20 like this:

    systemctl stop docker.socket
    systemctl disable docker.socket
    systemctl disable docker

    cat > /etc/systemd/system/docker.service <<EOF
    [Unit]
    Description=Docker Application Container Engine
    Documentation=http://docs.docker.io
    After=network.target

    [Service]
    Type=notify
    EnvironmentFile=-/etc/sysconfig/docker
    ExecStart=/usr/bin/docker -d --selinux-enabled --dns 172.17.42.1
    Restart=on-failure
    LimitNOFILE=1048576
    LimitNPROC=1048576

    [Install]
    WantedBy=multi-user.target
    EOF

    systemctl enable docker
    systemctl start docker

This disable socket activation for docker, which means that systemd
is no longer responsible for creating the docker socket.  The docker
daemon itself will create the socket, and will create it owned by the
"docker" group (or any other group you specify in the --group command
line option).

This change will persist after a reboot (unlike manually chmod'ing the
socket created by systemd).

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1119282] [Regression] Unable to run docker client as non-root user

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1119282

Fedora Update System <updates(a)fedoraproject.org&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |MODIFIED



-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1119282] [Regression] Unable to run docker client as non-root user

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1119282



--- Comment #9 from Fedora Update System <updates(a)fedoraproject.org&gt; ---
systemd-208-20.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/systemd-208-20.fc20

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1119282] [Regression] Unable to run docker client as non-root user

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1119282

Fedora Update System <updates(a)fedoraproject.org&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|MODIFIED                    |ON_QA



--- Comment #10 from Fedora Update System <updates(a)fedoraproject.org&gt; ---
Package systemd-208-20.fc20:
* should fix your issue,
* was pushed to the Fedora 20 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing systemd-208-20.fc20'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-8572/systemd-208-20.fc20
then log in and leave karma (feedback).

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1119282] [Regression] Unable to run docker client as non-root user

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1119282

Fedora Update System <updates(a)fedoraproject.org&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ON_QA                       |CLOSED
   Fixed In Version|                            |systemd-208-20.fc20
         Resolution|---                         |ERRATA
        Last Closed|                            |2014-07-21 23:30:31



--- Comment #11 from Fedora Update System <updates(a)fedoraproject.org&gt; ---
systemd-208-20.fc20 has been pushed to the Fedora 20 stable repository.  If
problems still persist, please make note of it in this bug report.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1119282] [Regression] Unable to run docker client as non-root user

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1119282



--- Comment #12 from Pete Savage <psavage(a)redhat.com&gt; ---
Is there a way to get this fixed in fc19 too?

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1119282] [Regression] Unable to run docker client as non-root user

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1119282



--- Comment #13 from Lokesh Mandvekar <lsm5(a)fedoraproject.org&gt; ---
Hi Peter, looks like the systemd folks only pushed it for f20, I could push the
non-socket-activation version for f19 which would take care of this bug.

Also just fyi, f21 might be out soon (still few days to go I think), making f19
end-of-life.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1119282] [Regression] Unable to run docker client as non-root user

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1119282



--- Comment #14 from Lokesh Mandvekar <lsm5(a)fedoraproject.org&gt; ---
s/Peter/Pete (sorry about that)

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1119282] [Regression] Unable to run docker client as non-root user

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1119282



--- Comment #15 from Zbigniew Jędrzejewski-Szmek <zbyszek(a)in.waw.pl&gt; ---
It seems that the patch is easy to backport from F20 to F19, so I'll release a
patched systemd-204 for F19 too.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1119282] [Regression] Unable to run docker client as non-root user

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1119282



--- Comment #16 from Pete Savage <psavage(a)redhat.com&gt; ---
Thanks

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1119282] [Regression] Unable to run docker client as non-root user

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1119282



--- Comment #17 from Lokesh Mandvekar <lsm5(a)fedoraproject.org&gt; ---
(In reply to Zbigniew Jędrzejewski-Szmek from comment #15)
>  It seems that the patch is easy to backport from F20 to F19, so
> I'll release
>  a patched systemd-204 for F19 too. 
coool, thanks so much :)

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1119282] [Regression] Unable to run docker client as non-root user

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1119282

Zbigniew Jędrzejewski-Szmek <zbyszek(a)in.waw.pl&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |yajo.sk8(a)gmail.com



--- Comment #18 from Zbigniew Jędrzejewski-Szmek <zbyszek(a)in.waw.pl&gt; ---
*** Bug 1121977 has been marked as a duplicate of this bug. ***

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1119282] [Regression] Unable to run docker client as non-root user

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1119282



--- Comment #19 from Fedora Update System <updates(a)fedoraproject.org&gt; ---
systemd-204-20.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/systemd-204-20.fc19

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1119282] [Regression] Unable to run docker client as non-root user

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1119282

Marek Goldmann <mgoldman(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |redhat_bugzilla(a)jake8us.org



--- Comment #20 from Marek Goldmann <mgoldman(a)redhat.com&gt; ---
*** Bug 1124925 has been marked as a duplicate of this bug. ***

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1119282] [Regression] Unable to run docker client as non-root user

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1119282

Fedora Update System <updates(a)fedoraproject.org&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Fixed In Version|systemd-208-20.fc20         |systemd-204-20.fc19



--- Comment #21 from Fedora Update System <updates(a)fedoraproject.org&gt; ---
systemd-204-20.fc19 has been pushed to the Fedora 19 stable repository.  If
problems still persist, please make note of it in this bug report.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1119282] [Regression] Unable to run docker client as non-root user

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1119282

hallajs(a)gmail.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |hallajs(a)gmail.com
              Flags|                            |needinfo?



--- Comment #22 from hallajs(a)gmail.com ---
This issue still persists on fc22, mind sharing if a fix would be deployed?

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1119282] [Regression] Unable to run docker client as non-root user

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1119282

Lars Kellogg-Stedman <lars(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|needinfo?                   |



--- Comment #23 from Lars Kellogg-Stedman <lars(a)redhat.com&gt; ---
hallajs: it was an intentional configuration change that running "docker"
requires root privileges, because having docker access effectively gives you
root on the system.  Because this is a security issue, the default
configuration is unlikely to change.

If you don't have these particular concerns in your own environment, you can
simply configure your system to have a `docker` group, make sure you're a
member of that group, and make sure the `docker` daemon is configured to use
that group when it creates the socket.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1119282] [Regression] Unable to run docker client as non-root user

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1119282



--- Comment #24 from Yajo <yajo.sk8(a)gmail.com&gt; ---
The same is true with `sudo`, and you don't need to create the `wheel` group.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1119282] [Regression] Unable to run docker client as non-root user

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1119282



--- Comment #25 from Lars Kellogg-Stedman <lars(a)redhat.com&gt; ---
Yajo: While true, that's because sudo's primary purpose is privilege
escalation.  That is *not* the primary purpose of Docker, and it is highly
likely that the privilege-escalating aspects of Docker are not necessarily
obvious to everyone using it.

Anyway, I was just stating my understanding of why the changes were made.  If
folks want to see a change in this behavior, it would probably be better to
open a new bz for that specific request rather that continuing discussion on
this one that was closed last year.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1119282] [Regression] Unable to run docker client as non-root user

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1119282



--- Comment #26 from Yajo <yajo.sk8(a)gmail.com&gt; ---
New bug 1249986 opened.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1119282] [Regression] Unable to run docker client as non-root user

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1119282

Stef Walter <stefw(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |stefw(a)redhat.com



--- Comment #27 from Stef Walter <stefw(a)redhat.com&gt; ---
The difference between privilege escalation via sudo and that via docker is
that the former is audited, logged, and uses a well known privilege escalation
path.

Privilege escalation via the docker group (which is correctly not present by
default) is not audited, cannot be logged, is wide open, does not respect
SELinux contexts.

Even the upstream Docker project warns against this.

-- 
You are receiving this mail because:
You are on the CC list for the bug.