Skip to content

Add non-root user to the docker group for non-root Docker access #573

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
cheeyanglee merged 1 commit into from
Nov 21, 2025
Merged

Add non-root user to the docker group for non-root Docker access #573

cheeyanglee merged 1 commit into from
Nov 21, 2025

Conversation

@polmoorx
Copy link
Contributor

@polmoorx polmoorx commented Nov 11, 2025 •
edited
Loading

Merge Checklist

All boxes should be checked before merging the PR

  • The changes in the PR have been built and tested
  • [] cgmanifest file has been updated if required
  • Ready to merge

Description

The non-root user couldn’t run Docker commands without sudo because it was not part of the 'docker' group. Added a new script to automatically detect the default non-root user and add it to the docker group, This allows non-root to use Docker without sudo while keeping existing sudo behavior intact.

This allows guest to use Docker without sudo while keeping existing sudo behavior intact.

Any Newly Introduced Dependencies

NO

How Has This Been Tested?

Manually tested

@polmoorx polmoorx marked this pull request as ready for review November 11, 2025 16:32
@polmoorx polmoorx requested a review from a team as a code owner November 11, 2025 16:32
@polmoorx polmoorx force-pushed the add-guest-to-docker-group branch from d8af9ec to 8e53c38 Compare November 12, 2025 04:10
andy-vm
andy-vm requested changes Nov 12, 2025
View reviewed changes
Copy link
Contributor

@andy-vm andy-vm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this file is add-sudoer.sh, should not be mixed up with docker group, please add another script for docker group purpose

@polmoorx polmoorx force-pushed the add-guest-to-docker-group branch from 8e53c38 to 00b01f2 Compare November 12, 2025 06:10
@polmoorx
Copy link
Contributor Author

polmoorx commented Nov 12, 2025

this file is add-sudoer.sh, should not be mixed up with docker group, please add another script for docker group purpose

Hi @andy-vm,

Thanks for the review. I’ve moved the Docker group logic out of add-sudoer.sh into a new file called add-docker-group.sh. The new script handles adding the user to the Docker group. Image JSONs have been updated to include the script.

@andy-vm
Copy link
Contributor

andy-vm commented Nov 12, 2025

does the new script have execution permissions added? please build one new image and test

chmod +x script

@polmoorx
Copy link
Contributor Author

polmoorx commented Nov 12, 2025

does the new script have execution permissions added? please build one new image and test

chmod +x script

yes @andy-vm it has execution permissions and tested locally, working as expected.

andy-vm
andy-vm requested changes Nov 12, 2025
View reviewed changes
@polmoorx polmoorx force-pushed the add-guest-to-docker-group branch from 00b01f2 to d92fbcf Compare November 12, 2025 13:29
andy-vm
andy-vm previously approved these changes Nov 13, 2025
View reviewed changes
Copy link
Contributor

@andy-vm andy-vm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@polmoorx polmoorx force-pushed the add-guest-to-docker-group branch 3 times, most recently from b2ec62b to a64c35f Compare November 14, 2025 13:26
@cheeyanglee
Copy link
Contributor

cheeyanglee commented Nov 17, 2025

why is this needed for most of the image? only -dev image have default guest user

@polmoorx polmoorx force-pushed the add-guest-to-docker-group branch 2 times, most recently from beb0112 to 7f69222 Compare November 17, 2025 06:20
@polmoorx polmoorx changed the title Add guest user to docker group for non-root Docker access Add non-root user to the docker group for non-root Docker access Nov 17, 2025
@polmoorx
Copy link
Contributor Author

polmoorx commented Nov 17, 2025

why is this needed for most of the image? only -dev image have default guest user

Thanks for the review. Updated the PR, new script now automatically detects the default non-root user (e.g., guest in dev images, others in non-RT images) and adds that user to the docker group. This addresses the issue consistently across all image types.

@cheeyanglee
Copy link
Contributor

cheeyanglee commented Nov 17, 2025

why is this needed for most of the image? only -dev image have default guest user

Thanks for the review. Updated the PR, new script now automatically detects the default non-root user (e.g., guest in dev images, others in non-RT images) and adds that user to the docker group. This addresses the issue consistently across all image types.

default user doesnt mean it need docker group access. what is the problem this PR try to solve?

@polmoorx
Copy link
Contributor Author

polmoorx commented Nov 17, 2025

why is this needed for most of the image? only -dev image have default guest user

Thanks for the review. Updated the PR, new script now automatically detects the default non-root user (e.g., guest in dev images, others in non-RT images) and adds that user to the docker group. This addresses the issue consistently across all image types.

default user doesnt mean it need docker group access. what is the problem this PR try to solve?

Based on ticket ITEP-81113, the normal user in the images is unable to run Docker commands because it is not part of the docker group. As a result, Docker operations fail with a “permission denied” error.

This PR resolves the issue by adding the primary non-root user to the docker group, ensuring Docker works as expected for the intended user.

@polmoorx polmoorx force-pushed the add-guest-to-docker-group branch from 7f69222 to efc4af9 Compare November 17, 2025 07:30
@cheeyanglee
Copy link
Contributor

cheeyanglee commented Nov 17, 2025

his PR resolves the issue by adding the primary non-root user to the docker group, ensuring Docker works as expected for the intended user.

this is fine for -dev image with default non-root user (guest) added [1] as we added the guest user for development and test purpose only.
This is not appropriate for image without default non-root user, these permissions should be manage by cloud-init or the root user.

[1] https://github.com/open-edge-platform/edge-microvisor-toolkit/pull/573/files#diff-5470aff6ec3ad901ddaf3e5a5c221137fb3dc629a924df7ad94c306a321fc65aR132

@polmoorx polmoorx force-pushed the add-guest-to-docker-group branch from efc4af9 to a657443 Compare November 19, 2025 08:38
@polmoorx
Copy link
Contributor Author

polmoorx commented Nov 19, 2025 •
edited
Loading

his PR resolves the issue by adding the primary non-root user to the docker group, ensuring Docker works as expected for the intended user.

this is fine for -dev image with default non-root user (guest) added [1] as we added the guest user for development and test purpose only. This is not appropriate for image without default non-root user, these permissions should be manage by cloud-init or the root user.

[1] https://github.com/open-edge-platform/edge-microvisor-toolkit/pull/573/files#diff-5470aff6ec3ad901ddaf3e5a5c221137fb3dc629a924df7ad94c306a321fc65aR132

Hi @cheeyanglee,

As per the latest comment in ITEP-81113 the issue is not ibserving in cloud-init and the issue is only observed in dev image and in dev image the the gusest user is hardcoded hence the PR is fixed for dev images alone and working as expected

his PR resolves the issue by adding the primary non-root user to the docker group, ensuring Docker works as expected for the intended user.

this is fine for -dev image with default non-root user (guest) added [1] as we added the guest user for development and test purpose only. This is not appropriate for image without default non-root user, these permissions should be manage by cloud-init or the root user.

[1] https://github.com/open-edge-platform/edge-microvisor-toolkit/pull/573/files#diff-5470aff6ec3ad901ddaf3e5a5c221137fb3dc629a924df7ad94c306a321fc65aR132

Hi @cheeyanglee,
Thank you.
Based on the latest update in ITEP-81113, the issue isn’t seen in cloud-init. It only appears in the dev images, where the guest user is added for development and testing.
Hence, the PR has been updated to fix the dev images by adding the guest user to the docker group.
For reference please see below attached snippet from dev-image.
image

@polmoorx polmoorx force-pushed the add-guest-to-docker-group branch from a657443 to 1d81f6b Compare November 20, 2025 04:12
@polmoorx
Add guest user to the docker group for docker access
b7f1254 
The guest user couldn’t run Docker commands without sudo because it
was not part of the 'docker' group. A new script added to ensure the
guest user added to the docker group, This allows guest user to use
Docker without sudo while keeping existing sudo behavior intact.

Signed-off-by: Polmoorx Shiva Kumar <[email protected]>
@polmoorx polmoorx force-pushed the add-guest-to-docker-group branch from 1d81f6b to b7f1254 Compare November 20, 2025 11:02
@cheeyanglee cheeyanglee merged commit dcb4cd1 into open-edge-platform:3.0-dev Nov 21, 2025
9 of 12 checks passed
liulis-sg pushed a commit that referenced this pull request Nov 25, 2025
@polmoorx @liulis-sg
Add guest user to the docker group for docker access (#573)
3138744 
The guest user couldn’t run Docker commands without sudo because it
was not part of the 'docker' group. A new script added to ensure the
guest user added to the docker group, This allows guest user to use
Docker without sudo while keeping existing sudo behavior intact.

Signed-off-by: Polmoorx Shiva Kumar <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cheeyanglee cheeyanglee cheeyanglee approved these changes

@magerstam magerstam magerstam approved these changes

@andy-vm andy-vm andy-vm left review comments

Assignees

@polmoorx polmoorx

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@polmoorx @andy-vm @cheeyanglee @magerstam