How to run docker image as a non-root user?

Question

I'm new to docker. When I run a docker images like ubuntu image by using the command,

sudo docker run -i -t ubuntu:14.04

By default, it is entering into the container as root like this.

I searched regarding this, but I couldn't get any of how to start a docker image as a non root user as I'm completely a starter for this topic.

It would be great if someone explains with an example of how to run a docker image as a non root user.

Answer 1

This is admittedly hacky, but good for those quick little containers you start just to test something quickly:

#!/bin/bash

set -eu

NAME=$1
IMG=$2

#UID=$(id -u)
USER=$(id -un)
GID=$(id -g)
GROUP=$(id -gn)

# --privileged needed for dmidecode
docker run --privileged -d -v /tmp:/tmp -v "/home/$USER:/home/$USER" -h "$NAME" --name "$NAME" "$IMG" init

docker exec "$NAME" /bin/bash -c "groupadd -g $GID $GROUP && useradd -M -s /bin/bash -g $GID -u $UID $USER"

Full version of the script I use here:

https://github.com/ericcurtin/staging/blob/master/d-run

Answer 2

It is not advisable to allow running docker without sudo as Docker has no auditing or logging built in, while sudo does. If you want to give docker access to non-root users Red Hat recommends setting up sudo. Add an entry like the following to /etc/sudoers.

dwalsh        ALL=(ALL)       NOPASSWD: /usr/bin/docker

Now, set up an alias in ~/.bashrc for running the docker command:

alias docker="sudo /usr/bin/docker"

Now when the user executes the docker command as non-root it will be allowed and get proper logging.

docker run -ti --privileged -v /:/host fedora chroot /host

Look at the journal or /var/log/messages.

journalctl -b | grep docker.*privileged
Aug 04 09:02:56 dhcp-10-19-62-196.boston.devel.redhat.com sudo[23422]:   dwalsh : TTY=pts/3 ; PWD=/home/dwalsh/docker/src/github.com/docker/docker ; USER=root ; COMMAND=/usr/bin/docker run -ti --privileged -v /:/host fedora chroot /host

Answer 3

the docker run command has the -u parameter to allow you to specify a different user. In your case, and assuming you have a user named foo in your docker image, you could run:

sudo docker run -i -t -u foo ubuntu:14.04 /bin/bash

NOTE: The -u parameter is the equivalent of the USER instruction for Dockerfile.