I need to deploy the Docker image, but I only want to use the Docker run command without using any of its arguments.
I want to assign special permission while running the container.
This is my Docker run command:
docker run --cap-add SYS_ADMIN --cap-add DAC_READ_SEARCH ping But I just want to use only:
docker run ping What changes should I do in my Docker file? I cannot use Docker Compose (not my usecase).
My Docker file:
4 Answers
You can that do with docker-compose.
This works for version 2 and 3. For example:
version: '2' services: myapp: cap_add: - SYS_ADMIN - DAC_READ_SEARCH You can't do that. An image can't grant itself elevated privileges to control the system it runs on; only the administrator actually running the docker run can do that.
It's better to wrap this in something like a Docker Compose YAML file or a shell script that includes all of the required docker run arguments.
If you're trying to build a "helper command" via Docker, there's two things worth remembering. One is that everyone who can run Docker commands has unrestricted root privileges over the host; it's very hard to stop someone from docker run -v /:/host -u root ... and getting unrestricted access to the host's filesystem. Another is that there are many Docker options like this (including setting environment variables, volume mounts, and publishing ports) that are set extremely routinely, so it's hard to build an image where just docker run imagename on its own brings up the image with full functionality.
Write a script like /usr/local/sbin/docker-ping.sh:
#!/bin/sh docker run --cap-add SYS_ADMIN --cap-add DAC_READ_SEARCH ping Then another script, /usr/local/bin/docker-ping:
#!/bin/sh sudo /usr/local/sbin/docker-ping.sh And finally modify sudo appropriately.
2If exist the docker group into the system, probably you don't need to use sudo command. As described on this link, append the group docker, and add your user to the group. That will avoid to use sudo. I have just tested other privileged commands and they worked without any issue for me. Repeating the steps into the above link:
sudo groupadd docker sudo usermod -aG docker $USER The docker daemon should be restarted to make effect the above, or restart the machine.
By the way, the focus of your question, the best option is to launch with a shell script as far as I know. It is good the approach indicated previously, but I would write this other one which allow pass arbitrary parameters and is more generic for any command you could need.
File: privileged-wrapper.sh
#!/bin/bash IMAGE_NAME="your_image_name" BINARY="$0" BINARY="${BINARY#./}" docker run --cap-add SYS_ADMIN --cap-add DAC_READ_SEARCH --rm "$IMAGE_NAME" "$BINARY" "$@" And now, you can create so many symbolic links as commands you need for those capabilities (keep in mind that the name of the symbolic link is the command to be launched into the container). It is expected the command to be launched is found into the PATH.
chmod a+x privileged-wrapper.sh ln -svf privileged-wrapper.sh ping Finally just launch:
./ping -c 10 
