Back to Engineering Notes
DockerEngineering Note

6. Docker Update Permissions

Allow the existing user rose on App Server 2 to run Docker commands without using sudo.

# Day 6: Docker Update Permissions

🎯 Objective

Allow the existing user rose on App Server 2 to run Docker commands without using sudo.

Normally, Docker commands require root privileges:

bash
sudo docker ps

The goal is to allow:

bash
docker ps

without sudo.

🧠 Concept

Docker uses a Unix socket to communicate with the Docker daemon:

plain text
/var/run/docker.sock

This socket is normally owned by:

plain text
root:docker

Users who belong to the docker group can access this socket and communicate with the Docker daemon without using sudo.

The permission flow is:

plain text
rose
  ↓
Add to docker group
  ↓
docker group has access to /var/run/docker.sock
  ↓
Docker daemon
  ↓
Run docker commands without sudo

🔍 Step 1: Check the User

Verify that rose exists and check the current group membership:

bash
id rose

Output:

plain text
uid=1001(rose) gid=1001(rose) groups=1001(rose)

This confirms that:

User rose exists
Primary group is rose
rose is not currently a member of the docker group

🐳 Step 2: Check the Docker Group

Check whether the docker group exists:

bash
getent group docker

Output:

plain text
docker:x:992:steve

This tells us:

plain text
Group Name → docker
Group ID   → 992
Member     → steve

At this point, rose is not a member.

🔐 Step 3: Check Docker Socket Permissions

Check the Docker daemon socket:

bash
ls -l /var/run/docker.sock

Output:

plain text
srw-rw---- 1 root docker 0 Aug 9 14:31 /var/run/docker.sock

Understanding the Output

plain text
srw-rw---- 1 root docker ...
│          │ │    │
│          │ │    └── Group: docker
│          │ └─────── Owner: root
│          └───────── Socket metadata
└──────────────────── Permissions

The permissions are:

plain text
srw-rw----

Breaking them down:

plain text
s        → Unix socket

rw-      → Owner (root) can read/write
rw-      → Group (docker) can read/write
---      → Others have no permission

The important part is:

plain text
root docker

Therefore, a user who belongs to the docker group can communicate with the Docker daemon through this socket.

> /var/run/docker.sock is not a command or executable file. It is a Unix socket used for communication between the Docker CLI and Docker daemon.

👤 Step 4: Add rose to the Docker Group

Add rose to the existing Docker group:

bash
sudo usermod -aG docker rose

Command Breakdown

plain text
usermod

Modifies an existing Linux user.

plain text
-a

Append the user to additional groups.

plain text
-G docker

Add the user to the docker supplementary group.

plain text
rose

The user being modified.

⚠️ Why aG Matters

Use:

bash
sudo usermod -aG docker rose

instead of:

bash
sudo usermod -G docker rose
a means append.

Without -a, existing supplementary group memberships could be replaced.

plain text
-a → Append
-G → Supplementary Groups

Therefore:

bash
sudo usermod -aG docker rose

is the safe command.

🔍 Step 5: Verify Group Membership

Check rose again:

bash
id rose

Output:

plain text
uid=1001(rose) gid=1001(rose) groups=1001(rose),992(docker)

Now we can see:

plain text
992(docker)

This confirms that rose has successfully been added to the Docker group.

Before

plain text
uid=1001(rose) gid=1001(rose) groups=1001(rose)

After

plain text
uid=1001(rose) gid=1001(rose) groups=1001(rose),992(docker)

The change is:

plain text
rose
 ├── 1001(rose)
 └── 992(docker) ✅

🔄 Session Note

Linux determines supplementary group membership when a login session starts.

If rose already has an active session, that existing session may not immediately recognize the new docker group membership.

A new login session will normally pick up the updated group membership.

The configuration itself can be verified with:

bash
id rose

which now shows:

plain text
992(docker)

⚙️ Complete Commands

Check User

bash
id rose

Output:

plain text
uid=1001(rose) gid=1001(rose) groups=1001(rose)

Check Docker Group

bash
getent group docker

Output:

plain text
docker:x:992:steve

Check Docker Socket

bash
ls -l /var/run/docker.sock

Output:

plain text
srw-rw---- 1 root docker 0 Aug 9 14:31 /var/run/docker.sock

Add User to Docker Group

bash
sudo usermod -aG docker rose

Verify

bash
id rose

Output:

plain text
uid=1001(rose) gid=1001(rose) groups=1001(rose),992(docker)

🔐 Security Note

Membership in the docker group provides powerful access to the system.

A Docker user can potentially:

Start privileged containers
Mount host directories
Access host files
Perform operations that can effectively provide root-level access

Therefore, only trusted users should be added to the docker group.

🧪 Validation Checklist

[ ] User rose exists
[ ] Docker group exists
[ ] Docker socket belongs to root:docker
[ ] Docker group has read/write access to the socket
[ ] Added rose to the Docker group
[ ] id rose shows 992(docker)
[ ] Existing group membership was preserved

📌 Summary

The Docker socket permissions are:

bash
ls -l /var/run/docker.sock
plain text
srw-rw---- 1 root docker 0 Aug 9 14:31 /var/run/docker.sock

This means the docker group has read/write access to the Docker socket.

Initially:

bash
id rose

returned:

plain text
uid=1001(rose) gid=1001(rose) groups=1001(rose)

Add rose to the Docker group:

bash
sudo usermod -aG docker rose

Verify:

bash
id rose

Result:

plain text
uid=1001(rose) gid=1001(rose) groups=1001(rose),992(docker)

The complete permission relationship is:

plain text
rose
  │
  │ member of
  ▼
docker group (GID 992)
  │
  │ rw permission
  ▼
/var/run/docker.sock
  │
  │ communication
  ▼
Docker daemon

The key takeaway is:

> /var/run/docker.sock is a Unix socket, not something we execute. Because the socket belongs to the dockergroup with read/write permissions, adding rose to that group allows the user to communicate with the Docker daemon without sudo.