{"id":20340576,"url":"https://github.com/0xrawsec/sudocker","last_synced_at":"2026-04-12T23:02:26.780Z","repository":{"id":134564127,"uuid":"276172057","full_name":"0xrawsec/sudocker","owner":"0xrawsec","description":"Sudocker allows one to restrict docker commands usage for regular system users (without additional privileges).","archived":false,"fork":false,"pushed_at":"2020-06-30T18:22:37.000Z","size":9,"stargazers_count":4,"open_issues_count":0,"forks_count":0,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-01-14T18:12:32.469Z","etag":null,"topics":["docker"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/0xrawsec.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-06-30T17:56:52.000Z","updated_at":"2024-01-11T17:36:40.000Z","dependencies_parsed_at":"2023-06-18T21:02:33.401Z","dependency_job_id":null,"html_url":"https://github.com/0xrawsec/sudocker","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xrawsec%2Fsudocker","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xrawsec%2Fsudocker/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xrawsec%2Fsudocker/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xrawsec%2Fsudocker/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/0xrawsec","download_url":"https://codeload.github.com/0xrawsec/sudocker/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":241867677,"owners_count":20033816,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["docker"],"created_at":"2024-11-14T21:22:38.747Z","updated_at":"2026-04-12T23:02:26.666Z","avatar_url":"https://github.com/0xrawsec.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Description\n\nSudocker allows one to restrict which user can run which docker\ncommand without the user being member of the docker group.\n\n# Motivation\n\nDocker is very powerful and useful but giving docker group membership\nto regular users is very risky. The reason is that being member of docker\ngroup is equivalent of being root on the machine hosting docker. I would \nqualify this as a security concern since it opens the door to easy priviledge\nescalation, but docker team prefers to say that it is intented. So, if like me \nyou would like to run docker containers from regular user account safely, you should \ntake a look to this project and why not installing the tool.\n\nThere is a non-exhaustive list of ways to get root on your docker host using\ndocker containers, assuming you can issue docker commands without restrictions.\n * using one of the mount overlay option to mount your own root filesystem\n   inside a container on which you are root. You can then modify of your host\n   with the root user available in the container.\n * using the `--privileged` options provided by several docker subcommands: https://github.com/moby/moby/issues/9976\n\n# Installation\n\n## From Source\n```\nmake\nsudo make install\n```\n\n## From Release\n```\nsudo ./install.sh\n```\n\n# Configuration\n\nEdit configuration file `/etc/sudocker/sudockers.toml`\n\n## Example\n### Basic\n\n```\n[policies]\n# john user is only allowed to run docker ps command\njohn = [\n    'docker ps',\n]\n```\n\n### Advanced \n\nThe configuration file also supports regex so it is easier to allow\ngroups of commands.\n\n```\n[policies]\nadmin = [\n    # !!! Doing this is not recommended\n    # allow any docker command (equivalent of being part of docker group)\n    # except that the user is not part of docker group, so he cannot access\n    # docker socket directly.\n    'docker .*?',\n]\n\njohn = [\n    # can run any docker ps command\n    'docker ps\\s*?.*',\n    # can run alpine container only with some options\n    'docker run ((--rm|-i|-t) )*alpine .*',\n]\n```\n\n# Proposed Workflow\n\n1. build images and create containers from a privileged account\n2. interact with containers in a restricted manner with the help of sudocker\n\n# Issues\n\nOpen issues on this github project\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0xrawsec%2Fsudocker","html_url":"https://awesome.ecosyste.ms/projects/github.com%2F0xrawsec%2Fsudocker","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0xrawsec%2Fsudocker/lists"}