Accessing docker on a tcp port for non-root users

Posted by {"name"=>"Palash Ray", "email"=>"paawak@gmail.com", "url"=>"https://www.linkedin.com/in/palash-ray/"} on November 01, 2017 · 1 min read

Well, it seems that running docker for non-root users is trivial. You can just add your user to the docker usergroup as mentioned below:
https://docs.docker.com/engine/installation/linux/linux-postinstall/#manage-docker-as-a-non-root-user
However, it might not be the best idea, as there are security implications:
https://docs.docker.com/engine/security/security/#docker-daemon-attack-surface
In the default docker installation, the dockerd listens on a Unix socket: /var/run/docker.sock, which in some Linux distros like CentOS and RHEL, can only be accessed by root user or users in the sudo group. This becomes an issue especially, for example, when we try to run docker through a Maven plugin.
The solution is to enable the docker daemon to listen on a tcp socket. This can be done by:

vi /lib/systemd/system/docker.service

Edit the below line as shown:

ExecStart=/usr/bin/dockerd -H unix:///var/run/docker.sock -H tcp://localhost:2375

This will tell docker daemon to listen on port 2375 for tcp connection. Next, reload the configuration and restart dockerd:

systemctl daemon-reload
service docker restart

To test whether it is working, do:

curl http://localhost:2375/version

Now, you should be able to run docker as a non-root user, if you do:

docker -H localhost:2375 run hello-world

Better still, you can define the below variable:

export DOCKER_HOST=tcp://localhost:2375

With that, the below command should work fine:

docker run hello-world

Note that now, we can run the below Maven plugin without any issue:
https://github.com/spotify/dockerfile-maven
References:
https://www.ivankrizsan.se/2016/05/18/enabling-docker-remote-api-on-ubuntu-16-04/
https://www.virtuallyghetto.com/2014/07/quick-tip-how-to-enable-docker-remote-api.html
https://docs.docker.com/engine/reference/commandline/dockerd/#daemon-socket-option