Before submitting
Problem or motivation
On native Linux systems, a rootful Docker daemon normally exposes a socket such as /var/run/docker.sock that is only accessible to root and members of the docker group.
As a result, Devsy's local Docker provider fails with a permission error when the current user is not a member of that group.
Adding a daily user to the docker group is not an acceptable solution for some security-conscious users, because access to the Docker daemon is effectively equivalent to persistent root access. Running the entire devsy process as root is also undesirable, since it can create root-owned files and grants much broader privileges than necessary.
Rootless Docker/Podman is an alternative, but it is not suitable for every environment or workload.
Proposed solution
Please add an optional, explicitly configured privilege-elevation mechanism to the Docker provider.
Alternatives considered
Devsy already supports configuring DOCKER_PATH, so I tried setting it to a wrapper script similar to:
#!/bin/sh
exec pkexec "$docker_bin" "$@"
The polkit authentication dialog did appear, which confirms that the wrapper was invoked. However:
- Multiple authentication dialogs appeared at once.
- Devsy reported that the operation had failed before I had completed password entry.
Area
CLI, Desktop app
Acceptance criteria
No response
Additional context
No response
Before submitting
Problem or motivation
On native Linux systems, a rootful Docker daemon normally exposes a socket such as
/var/run/docker.sockthat is only accessible to root and members of thedockergroup.As a result, Devsy's local Docker provider fails with a permission error when the current user is not a member of that group.
Adding a daily user to the
dockergroup is not an acceptable solution for some security-conscious users, because access to the Docker daemon is effectively equivalent to persistent root access. Running the entiredevsyprocess as root is also undesirable, since it can create root-owned files and grants much broader privileges than necessary.Rootless Docker/Podman is an alternative, but it is not suitable for every environment or workload.
Proposed solution
Please add an optional, explicitly configured privilege-elevation mechanism to the Docker provider.
Alternatives considered
Devsy already supports configuring DOCKER_PATH, so I tried setting it to a wrapper script similar to:
#!/bin/sh
exec pkexec "$docker_bin" "$@"
The polkit authentication dialog did appear, which confirms that the wrapper was invoked. However:
Area
CLI, Desktop app
Acceptance criteria
No response
Additional context
No response