如何使用除根以外的其他用户访问容器中的docker守护进程

我试图运行构建docker映像的Jenkins容器。我上周开始使用docker，我对使用主机卷以及如何处理用户感到困惑。如何使用除根以外的其他用户访问容器中的docker守护进程

我一直在互联网上搜索，我发现一个git问题是有人发布了一个解决方案，从容器中访问docker守护进程。基本上，这个想法是詹金斯容器内丘包含泊坞窗bin文件夹和docker.sock从主机这样的卷：

 volumes: 
     - /var/run/docker.sock:/var/run/docker.sock 
     - /usr/local/bin/docker:/usr/local/bin/docker

我已经做了和它的作品，但只有当我的根。当我开始学习docker的时候，我在博客中关注了这个例子，作者不是直接使用jenkins镜像，而是从jenkins镜像本身和它的依赖关系中复制了Dockerfiles来解释这个过程。作为该过程的一部分，创建一个jenkins用户，并在启动容器时使用该用户。我现在的问题是，我无法让詹金斯用户有权访问docker.sock，因为它属于根目录，而docker属于主机。我尝试在Dockerfile中添加用户docker，但在访问docker.sock时，我仍然从Jenkins作业中获得了权限被拒绝的错误。如果我检查在容器内部安装的/var/run/docker.sock，我可以看到docker.sock属于组user而不是docker，所以我不知道挂载目录时到底发生了什么。我没有用Linux做过多的工作，所以我猜测当用户docker在挂载目录时不存在，然后它使用默认的user，但我可能完全错误。

我还没有得到的另一件事是，如果我创建一个专门用作Jenkins容器的容器，并且没有别的东西应该在那里运行，那么创建特定jenkins用户的目的是什么？我有什么理由不能直接使用用户root？

这是我使用的Dockerfile。谢谢。

FROM centos:7 

# Yum workaround to stalled mirror 
RUN sed -i -e 's/enabled=1/enabled=0/g' /etc/yum/pluginconf.d/fastestmirror.conf 

RUN rm -f /var/lib/rpm/__* 
RUN rpm --rebuilddb -v -v 
RUN yum clean all 


# see https://bugs.debian.org/775775 
# and https://github.com/docker-library/java/issues/19#issuecomment-70546872 
ENV CA_CERTIFICATES_JAVA_VERSION 20140324 

RUN yum -v install -y \ 
    wget \ 
    zip \ 
    which \ 
    openssh-client \ 
    unzip \ 
    java-1.8.0-openjdk-devel \ 
    git \ 
    && yum clean all 

#RUN /var/lib/dpkg/info/ca-certificates-java.postinst configure 

# Install Tini 
ENV TINI_VERSION 0.9.0 
ENV TINI_SHA fa23d1e20732501c3bb8eeeca423c89ac80ed452 

# Use tini as subreaper in Docker container to adopt zombie processes 
RUN curl -fsSL https://github.com/krallin/tini/releases/download/v${TINI_VERSION}/tini-static -o /bin/tini && chmod +x /bin/tini \ 
    && echo "$TINI_SHA /bin/tini" | sha1sum -c - 

# SET Jenkins Environment Variables 
ENV JENKINS_HOME /var/jenkins_home 
ENV JENKINS_SLAVE_AGENT_PORT 50000 
ENV JENKINS_VERSION 2.22 
ENV JENKINS_SHA 5b89b6967e7af8119c52c7e86223b47665417a22 
ENV JENKINS_UC https://updates.jenkins-ci.org 
ENV COPY_REFERENCE_FILE_LOG $JENKINS_HOME/copy_reference_file.log 

# SET Java variables 
ENV JAVA_HOME /usr/lib/jvm/java/jre 
ENV PATH /usr/lib/jvm/java/bin:$PATH 

# Jenkins is run with user `jenkins`, uid = 1000 
# If you bind mount a volume from the host or a data container, 
# ensure you use the same uid 
RUN useradd -d "$JENKINS_HOME" -u 1000 -m -s /bin/bash jenkins 

#Not working. Folder not yet mounted? 
#RUN DOCKER_GID=$(stat -c '%g' /var/run/docker.sock) && \ 

#Using gid from host 
RUN groupadd -for -g 50 docker && \ 
    usermod -aG docker jenkins 

# Jenkins home directory is a volume, so configuration and build history 
# can be persisted and survive image upgrades 
VOLUME /var/jenkins_home 

# `/usr/share/jenkins/ref/` contains all reference configuration we want 
# to set on a fresh new installation. Use it to bundle additional plugins 
# or config file with your custom jenkins Docker image. 
RUN mkdir -p /usr/share/jenkins/ref/init.groovy.d 

# Install Jenkins 
RUN curl -fL http://repo.jenkins-ci.org/public/org/jenkins-ci/main/jenkins-war/${JENKINS_VERSION}/jenkins-war-${JENKINS_VERSION}.war -o /usr/share/jenkins/jenkins.war \ 
    && echo "$JENKINS_SHA /usr/share/jenkins/jenkins.war" | sha1sum -c - 

ENV JAVA_OPTS="-Xmx8192m" 
ENV JENKINS_OPTS="--logfile=/var/log/jenkins/jenkins.log --webroot=/var/cache/jenkins/war" 

# Prep Jenkins Directories 
RUN chown -R jenkins "$JENKINS_HOME" /usr/share/jenkins/ref 
RUN mkdir /var/log/jenkins 
RUN mkdir /var/cache/jenkins 
RUN chown -R jenkins:jenkins /var/log/jenkins 
RUN chown -R jenkins:jenkins /var/cache/jenkins 

# Expose Ports for web and slave agents 
EXPOSE 8080 
EXPOSE 50000 

# Copy in local config files 
COPY init.groovy /usr/share/jenkins/ref/init.groovy.d/tcp-slave-agent-port.groovy 
COPY jenkins.sh /usr/local/bin/jenkins.sh 
COPY plugins.sh /usr/local/bin/plugins.sh 
RUN chmod +x /usr/local/bin/plugins.sh 
RUN chmod +x /usr/local/bin/jenkins.sh 


# Install default plugins 
COPY plugins.txt /tmp/plugins.txt 
RUN /usr/local/bin/plugins.sh /tmp/plugins.txt 


# Add ssh key 
RUN eval "$(ssh-agent -s)" 
RUN mkdir /usr/share/jenkins/ref/.ssh && \ 
    chmod 700 /usr/share/jenkins/ref/.ssh && \ 
    ssh-keyscan github.com > /usr/share/jenkins/ref/.ssh/known_hosts 

COPY id_rsa /usr/share/jenkins/ref/.ssh/id_rsa 
COPY id_rsa /usr/share/jenkins/ref/.ssh/id_rsa.pub 
COPY hudson.tasks.Maven.xml /usr/share/jenkins/ref/hudson.tasks.Maven.xml 

RUN chown -R jenkins:jenkins /usr/share/jenkins/ref && \ 
    chmod 600 /usr/share/jenkins/ref/.ssh/id_rsa && \ 
    chmod 600 /usr/share/jenkins/ref/.ssh/id_rsa.pub && \ 
    chmod 600 /usr/share/jenkins/ref/hudson.tasks.Maven.xml 

COPY id_rsa /root/.ssh/id_rsa 
COPY id_rsa /root/.ssh/id_rsa.pub 

# ssh keys for root. To use root as the user 
RUN chmod 600 /root/.ssh/id_rsa && \ 
    chmod 600 /root/.ssh/id_rsa.pub && \ 
    ssh-keyscan github.com > /root/.ssh/known_hosts 

# Switch to the jenkins user 
USER jenkins 

# Tini as the entry point to manage zombie processes 
ENTRYPOINT ["/bin/tini", "--", "/usr/local/bin/jenkins.sh"]

来源

2017-03-16 Kilian

显然问题出在gid中。出于某种原因，我认为主持人的团队的码头工人的gid是50，但实际上它实际上是100.当我将它改为100时，jenkins工作开始工作。我仍然不知道为什么docker.sock显示它属于组user而不是docker在容器中。如果我在容器做cat /etc/group我看到

root:x:0: 
... 
users:x:100: 
... 
jenkins:x:1000: 
docker:x:100:jenkins

，并在宿主

root:x:0: 
lp:x:7:lp 
nogroup:x:65534: 
staff:x:50:docker 
docker:x:100:docker 
dockremap:x:101:dockremap

来源

2017-03-16 14:36:14 Kilian

外部主机和容器使用相同的数字UID/GID，但名称（泊坞窗，詹金斯等）可以不同。这是因为[namespaces]（https://en.wikipedia.org/wiki/Linux_namespaces）给每个容器自己的用户名称空间，PID，文件系统路径等等。 –

如何使用除根以外的其他用户访问容器中的docker守护进程

回答

相关问题