PR#4: Issue 3 - Check if sudo is really required to run docker - fedora-docs/template

fedora-docs / template

#4 Issue 3 - Check if sudo is really required to run docker

Merged 5 years ago by pbokoc. Opened 5 years ago by pbokoc.

fedora-docs/ pbokoc/template iss3 into master

Provide better messages on the command line

Petr Bokoc • 5 years ago

7b9b8a0

Issue 3 - Check if sudo is really required to run docker

Petr Bokoc • 5 years ago

69bed4b

build.sh

file modified

+14 -3

		`@@ -10,7 +10,18 @@`
		`# Running on Linux.`
		`# Let's assume that it's running the Docker deamon`
		`# which requires root.`
		`- echo ""`
		`- echo "This build script is using Docker to run the build in an isolated environment. You might be asked for a root password in order to start it."`
		`- sudo docker run --rm -it -v $(pwd):/antora:z antora/antora --html-url-extension-style=indexify site.yml`
		`+ if groups \| grep -wq "docker"; then`
		`+ # Check if the current user is in the "docker" group. If true, no sudo is needed.`
		`+ echo ""`
		`+ echo "This build script is using Docker to run the build in an isolated environment."`
		`+ echo ""`
		`+ docker run --rm -it -v $(pwd):/antora:z antora/antora --html-url-extension-style=indexify site.yml`
		`+ else`
		`+ # User isn't in the docker group; run the command with sudo.`
		`+ echo ""`
		`+ echo "This build script is using Docker to run the build in an isolated environment. You might be asked for your password."`
		`+ echo "You can avoid this by adding your user to the 'docker' group, but be aware of the security implications. See https://docs.docker.com/install/linux/linux-postinstall/."`
		`+ echo ""`
		`+ sudo docker run --rm -it -v $(pwd):/antora:z antora/antora --html-url-extension-style=indexify site.yml`
		`+ fi`
		`fi`

preview.sh

file modified

+17 -4

		`@@ -11,8 +11,21 @@`
		`# Running on Linux.`
		`# Let's assume that it's running the Docker deamon`
		`# which requires root.`
		`- echo ""`
		`- echo "This build script is using Docker to run the build in an isolated environment. You might be asked for a root password in order to start it."`
		`- echo "The preview will be available at http://localhost:8080/"`
		`- sudo docker run --rm -v $(pwd):/antora:ro,z -v $(pwd)/nginx.conf:/etc/nginx/conf.d/default.conf:ro,z -p 8080:80 nginx`
		`+ if groups \| grep -wq "docker"; then`
		`+ # Check if the current user is in the "docker" group. If true, no sudo is needed.`
		`+ echo ""`
		`+ echo "This build script is using Docker to run the build in an isolated environment."`
		`+ echo "The preview will be available at http://localhost:8080/"`
		`+ echo ""`
		`+ docker run --rm -v $(pwd):/antora:ro,z -v $(pwd)/nginx.conf:/etc/nginx/conf.d/default.conf:ro,z -p 8080:80 nginx`
		`+ else`
		`+ # User isn't in the docker group; run the command with sudo.`
		`+ echo ""`
		`+ echo "This build script is using Docker to run the build in an isolated environment. You might be asked for your password."`
		`+ echo "You can avoid this by adding your user to the 'docker' group, but be aware of the security implications. See https://docs.docker.com/install/linux/linux-postinstall/."`
		`+ echo ""`
		`+ echo "The preview will be available at http://localhost:8080/"`
		`+ echo ""`
		`+ sudo docker run --rm -v $(pwd):/antora:ro,z -v $(pwd)/nginx.conf:/etc/nginx/conf.d/default.conf:ro,z -p 8080:80 nginx`
		`+ fi`
		`fi`

pbokoc commented 5 years ago

This is a simple fix that adds a check for whether the user running the script is in the docker group or not. If they are, the command is run without sudo, if they are not, it's the same command with sudo and a message pointing out you can avoid that.

Fixes #3.

jflory7 commented 5 years ago

Yaaaay, this is exactly what I hoped for. Thanks @pbokoc! +1 from me. :thumbsup:

asamalik commented 5 years ago

I'm mostly +1.

Let's educate people it is not a good security practise, but let's make it work for them if they've already done that and they know what they're doing.

1 new commit added

Provide better messages on the command line

5 years ago

pbokoc commented 5 years ago

The terminal output is much better now, including a link to upstream Docker docs that talk about both how to actually add your user to the group as well as potential security problems stemming from that.