{"action":"created","issue":{"url":"https://api.github.com/repos/subuser-security/subuser/issues/223","labels_url":"https://api.github.com/repos/subuser-security/subuser/issues/223/labels{/name}","comments_url":"https://api.github.com/repos/subuser-security/subuser/issues/223/comments","events_url":"https://api.github.com/repos/subuser-security/subuser/issues/223/events","html_url":"https://github.com/subuser-security/subuser/issues/223","id":109641580,"number":223,"title":"Support separate docker user","user":{"login":"ruipgpinheiro","id":11169970,"avatar_url":"https://avatars.githubusercontent.com/u/11169970?v=3","gravatar_id":"","url":"https://api.github.com/users/ruipgpinheiro","html_url":"https://github.com/ruipgpinheiro","followers_url":"https://api.github.com/users/ruipgpinheiro/followers","following_url":"https://api.github.com/users/ruipgpinheiro/following{/other_user}","gists_url":"https://api.github.com/users/ruipgpinheiro/gists{/gist_id}","starred_url":"https://api.github.com/users/ruipgpinheiro/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ruipgpinheiro/subscriptions","organizations_url":"https://api.github.com/users/ruipgpinheiro/orgs","repos_url":"https://api.github.com/users/ruipgpinheiro/repos","events_url":"https://api.github.com/users/ruipgpinheiro/events{/privacy}","received_events_url":"https://api.github.com/users/ruipgpinheiro/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/subuser-security/subuser/labels/enhancement","name":"enhancement","color":"84b6eb"},{"url":"https://api.github.com/repos/subuser-security/subuser/labels/security","name":"security","color":"e11d21"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/subuser-security/subuser/milestones/7","html_url":"https://github.com/subuser-security/subuser/milestones/0.5","labels_url":"https://api.github.com/repos/subuser-security/subuser/milestones/7/labels","id":1181328,"number":7,"title":"0.5","description":null,"creator":{"login":"timthelion","id":1391608,"avatar_url":"https://avatars.githubusercontent.com/u/1391608?v=3","gravatar_id":"","url":"https://api.github.com/users/timthelion","html_url":"https://github.com/timthelion","followers_url":"https://api.github.com/users/timthelion/followers","following_url":"https://api.github.com/users/timthelion/following{/other_user}","gists_url":"https://api.github.com/users/timthelion/gists{/gist_id}","starred_url":"https://api.github.com/users/timthelion/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/timthelion/subscriptions","organizations_url":"https://api.github.com/users/timthelion/orgs","repos_url":"https://api.github.com/users/timthelion/repos","events_url":"https://api.github.com/users/timthelion/events{/privacy}","received_events_url":"https://api.github.com/users/timthelion/received_events","type":"User","site_admin":false},"open_issues":3,"closed_issues":5,"state":"open","created_at":"2015-06-25T16:11:06Z","updated_at":"2015-10-06T10:32:29Z","due_on":null,"closed_at":null},"comments":12,"created_at":"2015-10-03T19:49:02Z","updated_at":"2015-10-06T18:23:30Z","closed_at":null,"body":"While subuser is pretty great, there is still a relatively large problem due to docker - you must run it under a user belonging to the docker group, which effectively means any application running under that user has root access.\r\n\r\nThat wouldn't be a huge problem if almost everything was run under subuser, but I don't have the patience to do so, and will only sandbox a few specific applications that serve as common entry points (for example, firefox). Therefore, I needed some way to keep my main user account outside the docker group (in order to not give anything I might ever run easy root privileges), but still be able to run subuser applications.\r\n\r\nMy idea was to create a second user, 'subuser', which belongs to the docker group, and use it to run the docker applications themselves. Thing is, subuser does not allow itself to be run with a different user. You can use 'sudo', but then you run into a few problems with X11.\r\n\r\nThis could very likely be fixed right into the code-base, such that a user could configure the user to use to access the docker daemon.\r\n\r\nI managed to come up with this bash function as a workaround, which wraps around the 'subuser' command and calls it under a 'subuser' user:\r\n\r\n     subuser_alias() {\r\n          xhost +SI:localuser:subuser\r\n          sudo -u subuser XAUTHORITY=/home/subuser/.Xauthority DISPLAY=$DISPLAY -- xauth -v -i generate $DISPLAY . trusted\r\n          sudo -u subuser XAUTHORITY=/home/subuser/.Xauthority DISPLAY=$DISPLAY -- subuser $@\r\n     }\r\n     alias subuser='subuser_alias'\r\n\r\nSummed up, I add 'subuser' to the allowed users to access my X server, and then generate a new authority file for that user. Afterwards, I can just run subuser with the newly generated authority file and any given commands. I can then for example install firefox and whitelist \"xauth -v generate :0 . trusted\" as well as \"subuser run firefox\" under the 'subuser' user, in order to launch firefox without password prompts.\r\n\r\nAlternatively, give your main user write permissions to the subuser's .Xauthority file, and then use this bash method:\r\n\r\n     subuser_alias() {\r\n          xhost +SI:localuser:subuser\r\n          xauth -v -i extract /home/subuser/.Xauthority $DISPLAY\r\n          sudo -u subuser XAUTHORITY=/home/subuser/.Xauthority DISPLAY=$DISPLAY -- subuser $@\r\n     }\r\n     alias subuser='subuser_alias'\r\n\r\nFor both of these, you'll probably also need to modify your sudo env_keep variable, or subuser will try your /home/main_user/.Xauthority file instead.\r\n\r\nThere's probably better ways of doing it. And, of course, it'd be better if the code supported something like this by default."},"comment":{"url":"https://api.github.com/repos/subuser-security/subuser/issues/comments/145954100","html_url":"https://github.com/subuser-security/subuser/issues/223#issuecomment-145954100","issue_url":"https://api.github.com/repos/subuser-security/subuser/issues/223","id":145954100,"user":{"login":"ruipgpinheiro","id":11169970,"avatar_url":"https://avatars.githubusercontent.com/u/11169970?v=3","gravatar_id":"","url":"https://api.github.com/users/ruipgpinheiro","html_url":"https://github.com/ruipgpinheiro","followers_url":"https://api.github.com/users/ruipgpinheiro/followers","following_url":"https://api.github.com/users/ruipgpinheiro/following{/other_user}","gists_url":"https://api.github.com/users/ruipgpinheiro/gists{/gist_id}","starred_url":"https://api.github.com/users/ruipgpinheiro/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ruipgpinheiro/subscriptions","organizations_url":"https://api.github.com/users/ruipgpinheiro/orgs","repos_url":"https://api.github.com/users/ruipgpinheiro/repos","events_url":"https://api.github.com/users/ruipgpinheiro/events{/privacy}","received_events_url":"https://api.github.com/users/ruipgpinheiro/received_events","type":"User","site_admin":false},"created_at":"2015-10-06T18:23:30Z","updated_at":"2015-10-06T18:23:30Z","body":"Haven't been able to figure out why it happens, no. So yes, there is a bug :)"}}