You are not logged in.
Pages: 1
Hi to all.
I would like to use a program from github available as a docker image (https://github.com/koreader/koreader-sync-server) on my personal pc.
Reading the wiki page (https://wiki.archlinux.org/index.php/Docker) there are two warnings and I am not sure If I have understood them well.
The first one is this:
If you want to be able to run the docker CLI command as a non-root user, add your user to the docker user group, re-login, and restart docker.service.
Warning: Anyone added to the docker group is root equivalent because they can use the docker run --privileged command to start containers with root privileges. For more information see [3] and [4].
The second one is:
Daemon socket
By default, the Docker daemon serves the Docker API using a Unix socket at /var/run/docker.sock. This is an appropriate option for most use cases.
It is possible to configure the Daemon to additionally listen on a TCP socket, which can allow remote Docker API access from other computers. This can be useful for allowing docker commands on a host machine to access the Docker daemon on a Linux virtual machine, such as an Arch virtual machine on a Windows or macOS system.
Warning: The Docker API is unencrypted and unauthenticated by default. Remote TCP access to the Docker daemon is equivalent to unsecured remote root access unless TLS encryption and authorization is also enabled, either with an authenticating HTTP reverse proxy or with the appropriate additional Docker configuration. In general, enabling Docker API TCP sockets should be considered a high security risk.
Is the use of docker safe if avoiding to add my user to the docker group (should or could that group be deleted?) and using the standard socket without enabling TCP socket?
The fact that docker is run as root is a security issue if I use sudo to call it?
I've tried to use the docker-rootless, but the app does not work in such a case.
Offline
While your questions aren't really specific about exactly *what* your concerns are or what you are trying to accomplish, if you are concerned with running Docker with root privs, there are ways to do that with Docker, or otherwise take a look at Podman, which is specifically a daemon-less container engine, but also provides clear instructions on how to run it in rootless mode.
Offline
I'll give a look. However meantime I managed to have the container run in rootless mode so I'm not so much concerned about that warning in the wiki page.
Offline
Pages: 1