Permission denied to Docker daemon socket at unix:

Question

I have this Dockerfile:

FROM chekote/gulp:latest 

USER root
RUN apt-get update \
      && apt-get upgrade -y \
      && apt-get install -y sudo libltdl-dev

ARG dockerUser='my-user-name';
ARG group='docker';

# crate group if not exists
 RUN if ! grep -q -E "^$group:" /etc/group; then groupadd $group; fi

# create user if not exists
 RUN if ! grep -q -E "^$dockerUser:" /etc/passwd; then useradd -c 'Docker image creator' -m -s '/bin/bash' -g $group $dockerUser; fi

# add user to the group (if it was present and not created at the line above)
 RUN usermod -a -G ${group} ${dockerUser}

# set default user that runs the container
 USER ${dockerUser}

That I build this way:

docker build --tag my-gulp:latest .

and finally run by script this way:

#!/bin/bash

image="my-gulp:latest";
workDir='/home/gulp/project';

docker run -it --rm  \
-v $(pwd):${workDir} \
-v /var/run/docker.sock:/var/run/docker.sock \
-v /usr/bin/docker:/usr/bin/docker \
${image} /bin/bash

that logs me into the docker container properly but when I want to see images

docker images

or try to pull image

docker pull hello-world:latest

I get this error:

Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get http://%2Fvar%2Frun%2Fdocker.sock/v1.38/images/json: dial unix /var/run/docker.sock: connect: permission denied

How to create docker image from chekote/gulp:latest so I can use docker inside it without the error?

Or maybe the error is because of wrong docker run command?

Answer 1

You need the --privileged flag with your docker run command.

By the way , you can just use the docker in docker , image from docker for this kind of use case.

https://asciinema.org/a/24707

https://hub.docker.com/_/docker/

Answer 2

The error has nothing to do with docker pull or docker image subcommand, but rather that you need to call the the docker command as either a user with write access to the docker socket (for example, by being root, using sudo, or by being in the docker group).

Answer 3

A quick way to avoid that. Add your user to the group.

sudo gpasswd -a $USER docker

Then set the proper permissions.

sudo setfacl -m user:<your username>:rw /var/run/docker.sock

Should be good from there.

Answer 4

The permission matching happens only on numeric user ID and group ID. If the socket file is mode 0660 and owned by user ID 0 and group ID 32, and you're calling it as a user with user ID 1000 and group IDs 1000 and 16, it doesn't matter if one /etc/group file names gid 32 as docker and the other one names gid 16 the same; the numeric gids are different and you can't access the file. Also, since the actual numeric gid of the Docker group will vary across systems, this isn't something you can bake into the Dockerfile.

Many Docker images just run as root; if they do, they can access a bind-mounted Docker socket file regardless of its permissions.

If you run as a non-root user, you can use the docker run --group-add option to add a (numeric) gid to the effective user; it doesn't specifically need to be mentioned in the /etc/groups file. On a Linux host you might run:

docker run --group-add $(getent group docker | cut -d: -f3) ...

You wouldn't usually install sudo in a Dockerfile (it doesn't work well for non-interactive programs, you usually don't do a whole lot in interactive shells because of the ephemeral nature of containers, and you can always docker exec -u 0 to get a root shell) though installing some non-root user is often considered a best practice. You could reduce the Dockerfile to

FROM node:8
RUN apt-get update
# Trying to use the host's `docker` binary may not work well
RUN apt-get install -y docker.io
# Install the single node tool you need
RUN npm install -g gulp
# Get your non-root user
RUN adduser myusername
# Normal Dockerfile bits
WORKDIR ...
COPY ...
RUN gulp
USER myusername
CMD ["npm", "run", "start"]

(That Docker base image has a couple of things that don't really match Docker best practices, and doesn't seem to be updated routinely; I'd just use the standard node image as a base and add the one build tool you need on top of it.)