{"action":"created","issue":{"url":"https://api.github.com/repos/garywiz/chaperone-docker/issues/3","labels_url":"https://api.github.com/repos/garywiz/chaperone-docker/issues/3/labels{/name}","comments_url":"https://api.github.com/repos/garywiz/chaperone-docker/issues/3/comments","events_url":"https://api.github.com/repos/garywiz/chaperone-docker/issues/3/events","html_url":"https://github.com/garywiz/chaperone-docker/issues/3","id":115680800,"number":3,"title":"run chaplocal without being in docker group","user":{"login":"mc0e","id":1965393,"avatar_url":"https://avatars.githubusercontent.com/u/1965393?v=3","gravatar_id":"","url":"https://api.github.com/users/mc0e","html_url":"https://github.com/mc0e","followers_url":"https://api.github.com/users/mc0e/followers","following_url":"https://api.github.com/users/mc0e/following{/other_user}","gists_url":"https://api.github.com/users/mc0e/gists{/gist_id}","starred_url":"https://api.github.com/users/mc0e/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mc0e/subscriptions","organizations_url":"https://api.github.com/users/mc0e/orgs","repos_url":"https://api.github.com/users/mc0e/repos","events_url":"https://api.github.com/users/mc0e/events{/privacy}","received_events_url":"https://api.github.com/users/mc0e/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-11-07T17:50:58Z","updated_at":"2015-11-08T00:31:24Z","closed_at":null,"body":"As things stand, the chaplocal script doesn't work as intended unless run by a non-root user who is also a member of the docker group. Could we have the chaplocal script recognise when it can't access the docker socket, and call docker via sudo in those circumstances?\r\n\r\nHaving a user be a member of the docker group is convenient, and sometimes appropriate, but it's equivalent in power to having password-less sudo access, which is to say it's a security risk.  In most docker uses users can decide for themselves whether to take that risk, or use sudo, which may ask for a password.  I'd like to have chaplocal respect that decision and do the right thing when group based access to the docker socket is not available.\r\n\r\nCurrently,  If chaplocal is run as a non-root user without docker group access, then it will fail to run docker.  If chaplocal is run using sudo, then it will create the application directory as owned by root, both inside and outside the container.  root access will then continue to be needed to work on and run the container, and the intended permissions limits for the app in the container limits don't get applied.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/garywiz/chaperone-docker/issues/comments/154767552","html_url":"https://github.com/garywiz/chaperone-docker/issues/3#issuecomment-154767552","issue_url":"https://api.github.com/repos/garywiz/chaperone-docker/issues/3","id":154767552,"user":{"login":"mc0e","id":1965393,"avatar_url":"https://avatars.githubusercontent.com/u/1965393?v=3","gravatar_id":"","url":"https://api.github.com/users/mc0e","html_url":"https://github.com/mc0e","followers_url":"https://api.github.com/users/mc0e/followers","following_url":"https://api.github.com/users/mc0e/following{/other_user}","gists_url":"https://api.github.com/users/mc0e/gists{/gist_id}","starred_url":"https://api.github.com/users/mc0e/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mc0e/subscriptions","organizations_url":"https://api.github.com/users/mc0e/orgs","repos_url":"https://api.github.com/users/mc0e/repos","events_url":"https://api.github.com/users/mc0e/events{/privacy}","received_events_url":"https://api.github.com/users/mc0e/received_events","type":"User","site_admin":false},"created_at":"2015-11-08T00:31:24Z","updated_at":"2015-11-08T00:31:24Z","body":"The significant difference is that sudo may require a password, depending how it is configured."}}