Package: userdocker
UserdockerUserdocker is a wrapper that allows admins to grant restricted docker
commandline access to users.NoteUserdocker is currently in BETA state. Despite our ongoing efforts to test
on our local infrastructure, further testing, reviewing and feedback are
very welcome. Use with caution and watch the GitHub repo for issues and
new releases!Userdocker is aimed towards scientific high performance computing and cluster
setups, as they exist in most universities or research groups. Often, such
scientific computations have peculiar dependencies that are difficult to satisfy
across linux distributions (and drive admins crazy ;) ).In theory such use-cases could largely benefit from docker, as it would allow
users to easily define environments themselves and run them basically without
negative performance impact, as they run directly on the host’s kernel. In
reality however granting docker commandline access to users effectively makes
them root equivalent on the host (root in container, volume mount…), making
this prohibitive for cluster computing.Userdocker solves this problem by wrapping the docker command and just making
the safe parts available to users. Admins can decide what they consider safe
(with sane defaults). The userdocker command largely follows the docker
commandline syntax, so users can use it as an in-place replacement for the
docker command.Feedback / bugreports / contributions welcome:https://github.com/joernhees/userdockerSample Usage:# command line help (including subcommands the user is allowed to execute)sudouserdocker-h# (docker images) list images (and useful tree visualization)sudouserdockerimagessudouserdockerdockviz# (docker run) run a debian image with user (read-only) mounted homesudouserdockerrun-it--rm-v$HOME:$HOME:rodebianbash# (docker attach) re-attach to own container after connection losssudouserdockerattach438c7648e76b# (docker ps) list running containerssudouserdockerps# (docker pull / load) pull or loadsudouserdockerpulldebiansudouserdockerload<image.tar.gz# (nvidia-docker) extensions for nvidia GPU supportaliasnvidia-userdocker='userdocker --executor=nvidia-docker'NV_GPU=1,3,7nvidia-userdockerrun-it--rmnvcr.io/nvidia/tensorflowuserdockerps--gpu-useduserdockerps--gpu-freeFeatures:Similar commandline interface asdocker ...calleduserdocker ...Support for several docker commands / plugins (docker, nvidia-docker)Fine granular configurability for admins in/etc/userdocker/allows to:restrict runnable images if desired (allows admin reviews)restrict run to locally available imagesrestrict available mount points (or enforce them, or default mount)probe mounts (to make sure nfs automounts don’t make docker sad)enforce non-root user in container (same uid:gid as on host)enforce dropping capsenforce environment varsenforce docker argsrestrict port publishingexplicitly white-list available args to userrestrict allowed GPU access / reservations viaNV_GPUSystem wide config + overrides for individual groups, gids, users, uids.Easy extensibility for further subcommands and args.Installation:The installation of userdocker works in three steps:1. Install package:First make sure that docker is installed:sudodockerversionAfterwards, as userdocker is written in python3 and available as python package:sudopip3installuserdockerThis will give you auserdockercommand that you can test with:userdocker-hThe above is the preferable way of installation.Alternatively, you can clone this repo and execute:sudopython3setup.pyinstall2. Configuration:Copy the default config to/etc/userdocker/config.py, then edit the file.
The config contains tons of comments and explanations to help you make the right
decisions for your scenario.sudocp/etc/userdocker/default.py/etc/userdocker/config.py3. Allowing users to runsudo userdocker:You should now allow the users in question to runsudo userdocker. This is
basically done by adding a/etc/sudoers.d/userdockerfile. If you want to
grant this permission to all users in groupusers, add the following
two lines:Defaults env_keep += "NV_GPU"
%users ALL=(root) NOPASSWD: /usr/local/bin/userdockerThe first is strongly recommended in case you want to allow users to use nvidia
GPUs from within docker containers via nvidia-docker (see EXECUTORS in config).
Without it they cannot pass the NV_GPU environment variable to the userdocker
(and thereby nvidia-docker) command to select their desired GPU(s).FAQ:Why sudo?Because it supports logging and is in general a lot more configurable than the
alternatives. For example if you only want to makeuserdockeravailable on
some nodes in your cluster, you can use the Host_List field:%users node1,node2,node4=(root) /usr/local/bin/userdocker