How to Handle Docker group security issue using Testcontainers?

Question

I want to spin up a Testcontainer for a microservice in order to perform an IT on another microservice I'm currently developing. Now, when I'm launching the test, it fails because of a "permission denied" exception. This is because I'm on Linux and I need root permissions to execute docker commands (including startup of containers), which is of course something I cannot grant in a non interactive integration test. To "solve" this problem, it is generally said you should add your user to a dedicated docker group. This, however, basically gives the user passwordless root permissions... which is considered a security issue I want to avoid. So, are there any workarounds for this problem? How am I supposed to setup Testcontainers for ITs without exposing my system to this (potentially severe) security problem?

"his, however, basically gives the user passwordless root permissions..." No, it does not. It allows the user in question to do some of the things root can do - and that is something entirely different. — Markus W Mahlberg
– Markus W Mahlberg, Commented May 5 at 21:10
Since you can docker run -v /:/host -u root busybox ... you can do pretty much anything you want on the host as root if you can use Docker at all. Also see Docker daemon attach service in the core Docker documentation. The problem the asker highlights is in fact a significant problem with Testcontainers, and it's kind of intrinsic to the setup – the CI system does need to be given root-equivalent permissions for Testcontainers to work at all and that can be a problem. — David Maze
– David Maze, Commented May 5 at 23:16
@DavidMaze that's exactly my point. If I, for instance, have Jenkins running on my target server for deployments of my microservice, including integration tests: could I run Jenkins as a separate, non-login user who is in the docker group (in order to bypass the permission denied issue)? Wouldn't that reduce the attack vector? — Oidipous_REXX
– Oidipous_REXX, Commented May 6 at 20:23
If you're not using Docker rootless mode, then if you can run any docker command at all, you can take over the host system. That's true whether you're running docker as root or as a non-root user who can still access the Docker socket. (This is one of a couple of reasons I try to avoid testcontainers.) — David Maze
– David Maze, Commented May 7 at 10:03

BMitch · Accepted Answer · 2025-05-05 21:03:49Z

0

If you aren't on a system where you can have root access, then you and the administrator would need to install docker in rootless mode. This has lots of implications for networking and filesystem access, breaking lots of workflows, so you will want to configure and test it independent of testcontainers.

answered May 5 at 21:03

BMitch

271k51 gold badges555 silver badges511 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

How to Handle Docker group security issue using Testcontainers?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related