docker group or not

[cgwalters]

We need to decide whether to include a docker group or not. Today CL does, Fedora does not. Context: https://www.projectatomic.io/blog/2015/08/why-we-dont-let-non-root-users-run-docker-in-centos-fedora-or-rhel/

[JasonGiedymin]

Prefer from a security standpoint that docker group not exist. Many enterprise customers will appreciate that. At least as a good default. To force the group creation by default would bring multiple dependencies into the fold from a security perspective. That is, a dependency on having strong auditing in place, and have a strong means to react to said auditing. Something across the spectrum not all have.

I understand that from a "part-time user" standpoint (read: non sysadmin with responsibility over many nodes) it could be difficult to use. At the same time, It shouldn't be too difficult to create such a group and chown across the things that need chowning.

To me the question is what group do you focus on? Enterprise, or (for lack of a better name) Desktop Users? Do you offer a different flavor of the OS?

Maybe you make docker groups package that when installed does all the work, let the user decide?

[bgilbert]

If we made it optional, that would likely happen via an Ignition config and maybe some CT sugar. "Installing packages" on Fedora CoreOS is not exactly a thing.

[JasonGiedymin]

A system container image I mean.

…

-Jason

On Jul 25, 2018, at 5:22 PM, Benjamin Gilbert ***@***.***> wrote: If we made it optional, that would likely happen via an Ignition config and maybe some CT sugar. "Installing packages" on Fedora CoreOS is not exactly a thing. — You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread.

[bgilbert]

I'm hoping we don't have any of those either. 😁

[JasonGiedymin]

That’s cool too. Anything to make my life easier.

[chrisweeksnz]

The Fedora CoreOS tech preview has a docker group added, but configured so that users can't be added to it. The group appears to exist in /etc/gshadow, but not in /etc/group.

Running echo "$(getent group docker)" >> /etc/group restores normal function to the docker group (eg. usermod -aG docker myusername will grant access to the docker daemon).

[dustymabe]

So the open question here is whether we do one of these two options:

• we add a docker group to /etc/group so that usermod -aG docker myusername works?
• we encourage users to use sudo docker instead

[dustymabe]

We discussed this in the Fedora CoreOS meeting today.

* we are going to try to prioritize systemd-sysusers work for FCOS
    stable, but we will hackishly try to add docker to the /etc/group
    file to smooth the path for users who are currently using FCOS
    preview releases  (dustymabe, 17:06:48)

Basically we are going to prioritize work that will make usermod work generically in the future. In the short term we'll hack in the docker group to /etc/group so that other users don't hit this same issue in FCOS preview.

[ajeddeloh]

coreos/fedora-coreos-config#175 is a short term solution, do we want to reopen until we have the final solution? cc @dustymabe @jlebon

[dustymabe]

We are tracking the long term solution in coreos/rpm-ostree#49. It's not a ticket in this tracker though.

If we want to track here then I'd suggest we open a new ticket that isn't specific to the docker group.