feat(docker): linux privilege elevation for Docker and Podman providers by skevetter · Pull Request #737 · devsy-org/devsy

skevetter · 2026-07-24T15:39:49Z

Closes #732

Summary

Rootful Docker/Podman daemons expose a socket accessible only to root and the docker group, so the local provider fails with a permission error for users outside that group. Joining the group grants persistent root-equivalent access, and running the whole process as root is undesirable.

This adds an explicit, opt-in privilege-elevation mechanism:

New provider option DOCKER_ELEVATION (docker provider) and PODMAN_ELEVATION (podman provider): one of none (default), pkexec, sudo, doas.
When set, every docker/podman invocation is wrapped with the chosen helper via the single DockerHelper.buildCmd choke point.
Authentication happens once, up front at driver construction, warming the OS credential cache so an operation's many commands share a single prompt — rather than each command triggering its own dialog.
The one-time auth runs on its own generous timeout, keeping the interactive prompt out of the short (5s) per-command probe timeouts that would otherwise kill it mid-authentication.
Client-only runtime detection (--version) stays unelevated.

This resolves both problems reported in #732 when using a pkexec wrapper: multiple simultaneous auth dialogs, and the operation failing before password entry completed.

Notes

Elevation is for rootful daemons. For rootless Podman (the common case) leave it none — elevating would target a separate rootful instance.
pkexec targets local desktop sessions with a running polkit agent; use sudo/doas on headless/SSH hosts.

Summary by CodeRabbit

New Features
- Added optional privilege elevation for Docker and Podman commands.
- Supports pkexec, sudo, and doas with interactive authentication and one-time upfront authorization.
- Added provider configuration options (DOCKER_ELEVATION, PODMAN_ELEVATION) wired into runtime settings.
- Elevation is disabled by default and supports none to run normally.
Bug Fixes
- Invalid elevation settings now produce a clear configuration error.

…providers Rootful Docker/Podman daemons expose a socket accessible only to root and the docker group, so the local provider fails with a permission error for users outside that group. Adding an explicit, opt-in privilege-elevation mechanism lets those users run the provider without joining the group or running the whole process as root. Add a DOCKER_ELEVATION / PODMAN_ELEVATION option (none, pkexec, sudo, doas) that wraps every docker/podman invocation with the chosen helper. To avoid a prompt per command and to keep the interactive prompt out of the short per-command probe timeouts, authentication is performed once up front at driver construction, warming the OS credential cache for the rest of the operation. Client-only runtime detection stays unelevated.

netlify · 2026-07-24T15:39:55Z

✅ Deploy Preview for images-devsy-sh canceled.

Name	Link
🔨 Latest commit	`b0a6d4c`
🔍 Latest deploy log	https://app.netlify.com/projects/images-devsy-sh/deploys/6a63b4c44ff0f3000982a2ef

coderabbitai · 2026-07-24T15:39:57Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a6a356da-36eb-4905-9949-2132e128cf4e

📥 Commits

Reviewing files that changed from the base of the PR and between c0fa726 and b0a6d4c.

📒 Files selected for processing (3)

pkg/docker/elevate.go
pkg/docker/elevate_test.go
pkg/docker/helper.go

🚧 Files skipped from review as they are similar to previous changes (2)

pkg/docker/helper.go
pkg/docker/elevate.go

📝 Walkthrough

Walkthrough

Adds optional pkexec, sudo, or doas elevation for Docker and Podman commands, including provider configuration, one-time authentication, command wrapping, driver wiring, and unit tests.

Changes

Docker privilege elevation

Layer / File(s)	Summary
Elevation configuration flow `pkg/provider/provider.go`, `pkg/options/resolve.go`, `providers/docker/provider.yaml`, `providers/podman/provider.yaml`	Adds the elevation configuration field, provider options, defaults, and agent configuration wiring.
Elevation helper runtime `pkg/docker/elevate.go`, `pkg/docker/helper.go`	Selects supported helpers, authenticates once with a timeout, wraps Docker commands, and preserves direct execution when elevation is unset.
Driver wiring and validation `pkg/driver/docker/docker.go`, `pkg/docker/elevate_test.go`	Parses elevation settings during driver creation, performs initial authentication, and tests selection, wrapping, no-op behavior, and command construction.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant ProviderConfig
  participant NewDockerDriver
  participant DockerHelper
  participant Elevator
  participant DockerCLI
  ProviderConfig->>NewDockerDriver: provide elevation setting
  NewDockerDriver->>Elevator: create configured helper
  NewDockerDriver->>DockerHelper: EnsureElevated()
  DockerHelper->>Elevator: authenticate once
  Elevator->>DockerCLI: run helper with docker --version
  DockerHelper->>Elevator: wrap Docker command
  DockerHelper->>DockerCLI: execute elevated command

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	⚠️ Warning	Podman elevation support and its new provider option are outside linked issue `#732`, which only requests Docker-provider elevation.	Remove Podman-specific changes from this PR or link a separate issue if Podman elevation is intentionally in scope.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: optional privilege elevation for Docker and Podman providers.
Linked Issues check	✅ Passed	The Docker elevation helper, one-time auth flow, and new elevation config satisfy issue `#732`'s optional rootful socket access needs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

netlify · 2026-07-24T15:40:11Z

✅ Deploy Preview for devsydev canceled.

Name	Link
🔨 Latest commit	`b0a6d4c`
🔍 Latest deploy log	https://app.netlify.com/projects/devsydev/deploys/6a63b4c401953800087ece8a

Extract pkexec/sudo/doas string constants (goconst), wrap long lines (golines), and mark the trusted-config exec calls //nolint:gosec (G204).

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/docker/helper.go`:
- Around line 529-537: The buildCmd flow must preserve DockerHelper.Environment
across Elevator.wrap instead of allowing sudo/doas to discard provider
configuration such as DOCKER_HOST. Update the elevation handling around
EnsureElevated and Elevator.wrap to explicitly forward or allowlist the required
Docker configuration variables, or reject incompatible
elevation-plus-environment configurations before executing the command.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d4dca378-0bc6-46a6-9317-7906d1697aba

📥 Commits

Reviewing files that changed from the base of the PR and between b3896a6 and c0fa726.

📒 Files selected for processing (8)

pkg/docker/elevate.go
pkg/docker/elevate_test.go
pkg/docker/helper.go
pkg/driver/docker/docker.go
pkg/options/resolve.go
pkg/provider/provider.go
providers/docker/provider.yaml
providers/podman/provider.yaml

sudo/pkexec/doas reset the child environment, so provider-configured variables such as DOCKER_HOST (set via the docker/podman env block) were silently dropped when elevation was active. Forward them explicitly through env(1) so the elevated docker command receives the intended configuration.

github-actions Bot added the size/l label Jul 24, 2026

fix(docker): satisfy linters for elevation code

c0fa726

Extract pkexec/sudo/doas string constants (goconst), wrap long lines (golines), and mark the trusted-config exec calls //nolint:gosec (G204).

skevetter marked this pull request as ready for review July 24, 2026 16:41

coderabbitai Bot reviewed Jul 24, 2026

View reviewed changes

Comment thread pkg/docker/helper.go

skevetter changed the title ~~feat(docker): optional privilege elevation for Docker and Podman providers~~ feat(docker): linux privilege elevation for Docker and Podman providers Jul 24, 2026

skevetter marked this pull request as draft July 24, 2026 19:05

skevetter marked this pull request as ready for review July 24, 2026 22:06

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(docker): linux privilege elevation for Docker and Podman providers#737

feat(docker): linux privilege elevation for Docker and Podman providers#737
skevetter wants to merge 3 commits into
mainfrom
feat/docker-podman-privilege-elevation

skevetter commented Jul 24, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

netlify Bot commented Jul 24, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jul 24, 2026 •

edited

Loading

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

netlify Bot commented Jul 24, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

skevetter commented Jul 24, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Notes

Summary by CodeRabbit

Uh oh!

netlify Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for images-devsy-sh canceled.

Uh oh!

coderabbitai Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

netlify Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for devsydev canceled.

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

skevetter commented Jul 24, 2026 •

edited by coderabbitai Bot

Loading

netlify Bot commented Jul 24, 2026 •

edited

Loading

coderabbitai Bot commented Jul 24, 2026 •

edited

Loading

netlify Bot commented Jul 24, 2026 •

edited

Loading