メインコンテンツまでスキップ

Docker without sudo

By default, Docker commands require root privileges (sudo) to execute. However, with proper configuration, regular users can run Docker commands without sudo.

Why sudo is Required​

The Docker daemon binds to a Unix socket, which is owned by the root user by default. Therefore, the Docker CLI requires root privileges to communicate with the daemon.

Steps to Use Docker without sudo​

1. Create Docker Group​

Create the docker group. Users in this group can run Docker commands without root privileges.

sudo groupadd docker
If Group Already Exists

If the group already exists, this command will have no effect.

2. Add User to Docker Group​

Add the current user to the docker group:

sudo gpasswd -a $USER docker
Specifying Username

To add other users, replace $USER with the appropriate username.

Alternative Method​

You can also use the usermod command:

sudo usermod -aG docker $USER

3. Apply Group Changes​

To apply group changes without logging out and back in, use the newgrp command:

newgrp docker
About Session Changes

The newgrp command is only effective for the current session. To fully apply the settings, we recommend logging out and back in or restarting the system.

4. Test Configuration​

Verify that Docker works without sudo:

docker run hello-world

If successful, you'll see a message like this:

Hello from Docker!
This message shows that your installation appears to be working correctly.
...

Additional Verification Commands​

Check Docker Status​

# Check Docker daemon status
docker info

# Check Docker version
docker version

# Check current user's groups
groups

Detailed Permission Check​

# Check Docker socket permissions
ls -la /var/run/docker.sock

# Check current user ID
id

Troubleshooting​

Common Issues and Solutions​

1. "permission denied" Error​

docker: Got permission denied while trying to connect to the Docker daemon socket

Solution:

  • Verify user is added to docker group
  • Log out and log back in
  • Check if Docker service is running
# Check group membership
groups | grep docker

# Check Docker service status
sudo systemctl status docker

# Start Docker service
sudo systemctl start docker

2. Group Changes Not Applied​

Solution:

  1. Completely log out and log back in
  2. Restart the system
  3. Force application with these commands:
sudo systemctl restart docker
newgrp docker

3. Docker Daemon Won't Start​

# Enable Docker service
sudo systemctl enable docker

# Check detailed service status
sudo journalctl -u docker.service

Security Considerations​

Important Notes​

Security Risk

Members of the docker group have effectively root-equivalent privileges. This is because:

  1. Host Filesystem Access: Containers can mount the host filesystem
  2. Privilege Escalation Potential: Can run privileged containers
  3. System Resource Access: Control over network, processes, etc.

Guidelines for Safe Usage​

  1. Add Only Trusted Users

    # Add only necessary users to docker group
    sudo gpasswd -a trusted_user docker

  2. Regular Permission Review

    # Check docker group members
    getent group docker

  3. Consider Alternatives

    • Podman: Docker alternative with rootless execution capability
    • Docker Rootless Mode: Available in Docker 20.10+

Docker Rootless Mode​

Consider using Docker Rootless Mode as a safer alternative:

# Install Rootless Docker
curl -fsSL https://get.docker.com/rootless | sh

# Set environment variables
export PATH=$HOME/bin:$PATH
export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/docker.sock

References​