Skip to content

ewindisch/udocker

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

7 Commits
 
 
 
 
 
 

Repository files navigation

udocker

Run docker containers as untrusted local users, allowing users to run containers (only) under their current UID.

Users cannot configure volume mounts, enable privileged operations, or do other "unsafe" things with Docker. They cannot explicitly pull images, save images, or do anything else that may be unsafe. For safety purposes, all privileged capabilities are disabled, including NET_RAW and SETUID. Users should not expect to be able to use ICMP ping or setuid binaries from their images.

Usage

On the same host as a running Docker daemon:

$ udocker image [args...]

Installation

This depends the binary being installed as setgid 'docker', allowing access to the Docker socket.

$ go build udocker.go
$ chgrp docker udocker
$ chmod g+s udocker
$ mv udocker /usr/local/bin

Example

$ id
uid=1000(eric) gid=1000(eric)
groups=1000(eric)

$ udocker busybox id
iduid=1000(default) gid=1000(default)

$ udocker busybox echo "hello world"
hello world

About

No description, website, or topics provided.

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages