I changed my docker installation to rootless. I now installed Patchmon on the host and I wanted to monitor and update my Docker images as well. But Patchmon requires docker.sock to be in /var/run. My current docker.sock is of course in /run/user/{userid}. Are there any security risks, and if so what are they, to making a symlink to have the docker.sock in /var/run as well? The /run/user/{userid}/docker.sock is owned by the user running Docker. The symlink is owned by root because of the privileges needed for /var/run.

I don’t have enough knowledge to be doing these kind of things, but I just like to tinker and I want to know how insecure this setup could be.

  • Guadin@k.fe.derate.meOP
    1·
    2 days ago

    Thanks for the answer.

    1. Not really. I just never looked into podman and knew Docker already (as in, I can create container with docker compose).
    2. Running Patchmon in Docker does not work, it’s the patchmon-agent to update the host running docker. So it needs access to apt on the host.
    3. Perfect, it shows as root but the user owns the original .sock.
    4. Will not do.
    5. Didn’t think of that. Not a problem now but it could be in the feature.
    • groet@feddit.orgEnglish
      2·
      2 days ago

      Podman is pretty mutch a drop in replacement for docker but it runs in user context instead if root.

      All docker commands work with podman by just replacing the name including podman compose.

      (You do have to specify docker.io as a repository if you want to pull images from docker hub but that is literally the only difference In usage I ever noticed)