Docker, Linux: disable Docker commands for a user, but allow him running a Docker container

Task

At a Linux (CentOS8) machine, create an environment with Docker commands disabled for a particular user, but with a possibility for this user to run a Docker container

Solution approach

Use a restricted shell with modifications disabling some of well-known possibilities to break out from it

Solution details

1. Create a user with restrictions:

sudo adduser ruser

2. Set a password for ruser (type the password twice):

sudo passwd ruser

3. Create a restricted shell:

sudo cp /bin/bash /bin/rbash

4. Modify ruser settings. Force him to use restricted shell:

sudo usermod -s /bin/rbash ruser

5. Verify correctness of ruser settings in /etc/passwd:

sudo cat /etc/passwd

There should be a line containing:

ruser:x:1000:1000::/home/ruser:/bin/rbash

6. Create a directory which will contain commands available for ruser:

mkdir /home/ruser/commands

7. Modify PATH environment variable in ruser’s .bash_profile:

vi /home/ruser/.bash_profile

Add the following line to the bottom of the file:

export PATH=$HOME/commands

8. Log in as ruser (or execute a su):

su - ruser

9. Verify that the majority of commands are not available for ruser:

cd

as the shell is restricted, outputs:

-rbash: cd: restricted
ls

as ls is absent in /home/ruser/commands, outputs:

-rbash: ls: command not found
docker

just like for ls, due to the fact that docker is absent in /home/ruser/commands, outputs:

-rbash: docker: command not found

rbash and vi commands do not work either:

-rbash: rbash: command not found
-rbash: vi: command not found

trying to modify PATH variable does not work:

export PATH=/bin

outputs:

-rbash: PATH: readonly variable

10. Login as a user with sudo privileges

11. Create a script allowing ruser to run a Docker container:

vi /home/ruser/commands/runContainer

Add the following code to the runContainer file:

#!/bin/bash
export PATH=/bin
docker run -it someImageID

12. Add ruser to docker group:

sudo usermod -aG docker ruser

13. Log in as ruser

14. Execute runContainer:

runContainer

Observe that the interactive bash shell has been executed on the container.

15. Exit from the container:

exit

16. Verify that the PATH contains /home/ruser/commands:

echo $PATH

17. Verify that the docker command in the runContainer file cannot be executed:

docker run -it someImageID

outputs:

-rbash: docker: command not found

References: