代码改变世界

小知识:将普通用户加入到docker组

2021-11-11 09:29  AlfredZhao  阅读(131)  评论(0编辑  收藏  举报

新的OCI实例,OS选择的是OEL7.9,初始环境是没有安装docker的,我们可以直接使用yum安装,之后启动docker服务:

[opc@oci-001 ~]$ sudo yum install docker
[opc@oci-001 ~]$ sudo systemctl start docker

因为默认登陆用户是opc,安装后使用docker命令都需要sudo,否则会报错权限问题:

[opc@oci-001 ~]$ docker ps
Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.40/containers/json": dial unix /var/run/docker.sock: connect: permission denied
[opc@oci-001 ~]$ sudo docker ps
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES

为了操作方便,我们需要将opc用户加入到docker组中:

[opc@oci-001 run]$ sudo gpasswd -a opc docker
正在将用户“opc”加入到“docker”组中
[opc@oci-001 run]$ docker ps
Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.40/containers/json": dial unix /var/run/docker.sock: connect: permission denied
[opc@oci-001 run]$ id
uid=1000(opc) gid=1000(opc) 组=1000(opc),4(adm),10(wheel),190(systemd-journal) 环境=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
[opc@oci-001 run]$ id opc
uid=1000(opc) gid=1000(opc) 组=1000(opc),4(adm),10(wheel),190(systemd-journal),992(docker)
[opc@oci-001 run]$ id
uid=1000(opc) gid=1000(opc) 组=1000(opc),4(adm),10(wheel),190(systemd-journal) 环境=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

上面看到加入docker组后依然报错,但其实通过id和id opc验证很容易发现是当前shell没有生效,
此时需要重新登陆opc用户,再次尝试可以正常执行docker命令而无需sudo操作:

Enter your username: opc
Last login: Wed Nov 10 23:47:49 2021 from xxx.xxx.xxx.xxx
[opc@oci-001 ~]$ id
uid=1000(opc) gid=1000(opc) 组=1000(opc),4(adm),10(wheel),190(systemd-journal),992(docker) 环境=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
[opc@oci-001 ~]$ docker ps
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES
[opc@oci-001 ~]$ docker version
Client: Docker Engine - Community
 Version:           19.03.11-ol
 API version:       1.40
 Go version:        go1.16.2
 Git commit:        9bb540d
 Built:             Fri Jul 23 01:33:55 2021
 OS/Arch:           linux/amd64
 Experimental:      false

Server: Docker Engine - Community
 Engine:
  Version:          19.03.11-ol
  API version:      1.40 (minimum version 1.12)
  Go version:       go1.16.2
  Git commit:       9bb540d
  Built:            Fri Jul 23 01:32:08 2021
  OS/Arch:          linux/amd64
  Experimental:     false
  Default Registry: docker.io
 containerd:
  Version:          v1.4.8
  GitCommit:        7eba5930496d9bbe375fdf71603e610ad737d2b2
 runc:
  Version:          1.0.0-rc95
  GitCommit:        2856f01
 docker-init:
  Version:          0.18.0
  GitCommit:        fec3683

此时就可以正常操作docker命令了,但是还有一个情况,如果需要登陆需要登陆信息的docker镜像仓库,比如Oracle的官方镜像仓库:

[opc@oci-001 ~]$ docker login container-registry.oracle.com
Username: xxx@xx.com
Password:
WARNING! Your password will be stored unencrypted in /home/opc/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded

成功登陆后,可以正常拉取对应镜像:

[opc@oci-001 ~]$ docker pull container-registry.oracle.com/database/enterprise:19.3.0.0
Trying to pull repository container-registry.oracle.com/database/enterprise ...
19.3.0.0: Pulling from container-registry.oracle.com/database/enterprise
86607bb85307: Pull complete
9426f6bfa092: Pull complete
16f82e6c6196: Pull complete
3b3cb340bf3a: Pull complete
914616be8a89: Pull complete
72eda44db682: Pull complete
4f4fb700ef54: Pull complete
930126d48988: Pull complete
74776159d717: Pull complete
a75af7560303: Pull complete
768777aee4bd: Pull complete
83bc762e273b: Pull complete
40ae2cf39a7a: Pull complete
97f3b11e6fb5: Pull complete
49b970fb5707: Pull complete
49801e1d38a0: Pull complete
e0d849ef2418: Pull complete
31d732a7744f: Pull complete
760939c383f0: Pull complete
5c2969cb34b8: Pull complete
Digest: sha256:ea9cd805ec49368fd288323e3f41d6c6e45698813e2ae89fd5d097c026ab5aa6
Status: Downloaded newer image for container-registry.oracle.com/database/enterprise:19.3.0.0
container-registry.oracle.com/database/enterprise:19.3.0.0

注:之前做测试过程中,最开始没有将opc加入到docker组中,所以使用sudo操作,比如登陆用 sudo docker login方式登陆,配置文件会被存放到/root/.docker/config.json,给后面运维会带来一些麻烦。所以建议大家最开始就配置规划好使用docker的用户。

AlfredZhao©版权所有「从Oracle起航,领略精彩的IT技术。」