Skip to content

[Feature]: Add optional privilege elevation for the Docker provider (pkexec/sudo/doas) #732

Description

@sorubedo

Before submitting

  • I have searched existing issues and discussions to confirm this hasn't been requested

Problem or motivation

On native Linux systems, a rootful Docker daemon normally exposes a socket such as /var/run/docker.sock that is only accessible to root and members of the docker group.

As a result, Devsy's local Docker provider fails with a permission error when the current user is not a member of that group.

Adding a daily user to the docker group is not an acceptable solution for some security-conscious users, because access to the Docker daemon is effectively equivalent to persistent root access. Running the entire devsy process as root is also undesirable, since it can create root-owned files and grants much broader privileges than necessary.

Rootless Docker/Podman is an alternative, but it is not suitable for every environment or workload.

Proposed solution

Please add an optional, explicitly configured privilege-elevation mechanism to the Docker provider.

Alternatives considered

Devsy already supports configuring DOCKER_PATH, so I tried setting it to a wrapper script similar to:

#!/bin/sh
exec pkexec "$docker_bin" "$@"

The polkit authentication dialog did appear, which confirms that the wrapper was invoked. However:

  1. Multiple authentication dialogs appeared at once.
  2. Devsy reported that the operation had failed before I had completed password entry.

Area

CLI, Desktop app

Acceptance criteria

No response

Additional context

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions