chowning the host's bound `docker.sock` inside container breaks host docker

user_2560641 0
Viewed 348

On a vanilla install of Docker for Mac my docker.sock is owned by my local user:

$ stat -c "%U:%G" /var/run/docker.sock

juliano:staff

Even if I add the user and group on my Dockerfile, when trying to run DinD as me, the mount of the docker.sock is created with root:root.

$ docker run -it --rm \
    --volume /var/run/docker.sock:/var/run/docker.sock \
    --group-add staff \
    --user $(id -u):$(id -g) \
    "your-average-container:latest" \
    /bin/bash -c 'ls -l /var/run/docker.sock' 

srw-rw---- 1 root root 0 Jun 17 07:34 /var/run/docker.sock

Going the other way, running DinD as root, chowning the socket, then running commands breaks the host docker.

$ docker run -it --rm \
    --volume /var/run/docker.sock:/var/run/docker.sock \
    --group-add staff \
    "your-average-container:latest" \
    /bin/bash

$ chown juliano:staff /var/run/docker.sock
$ sudo su juliano
$ docker ps

[some valid docker output]

$ exit

$ docker ps

Error response from daemon: Bad response from Docker engine

I've seen people reporting chowning as the way to go, so maybe I'm doing something wrong.

Questions:

  • Why does the host docker break?
  • Is there some way to prevent host docker from breaking and still giving my user permission to the socket inside docker?
docker-in-docker docker ubuntu macos
1 Answers

I believe that when you are mounting the volume the owner UID/GID is set to the same as in the host machine (the --user flag simply allows you to run the command as a specific UID/GID and it doesn't have impact on the permission for mounted volume)

The main question is - why would you need to chown? Can't you just run the commands inside the container as root?

user_53599530
Related