Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
Get http:///var/run/docker.sock/v1.13/containers/json?all=1: dial unix /var/run/docker.sock: permission denied
Version-Release number of selected component (if applicable):
Updating docker-0.11.1-22.el7.x86_64 to docker-1.1.2-13.el7.x86_64
How reproducible: VERY
Steps to Reproduce:
1. yum update docker -y
Actual results:
$ docker ps -a
2014/09/22 13:38:49 Get http:///var/run/docker.sock/v1.13/containers/json?all=1: dial unix /var/run/docker.sock: permission denied
Expected results:
Users of the Docker group should be allowed to use / interact with the docker service.
Additional info:
Root User can still interact with Docker process.
Restarting docker serivce works, and reports no errors
However stopping the service reports the following:
# systemctl stop docker.service
Warning: Stopping docker.service, but it can still be activated by:
docker.socket
# lsof | grep /var/run/docker.sock
systemd 1 root 27u unix 0xffff880079353a40 0t0 180497 /var/run/docker.sock
Reloading system also did not help, or re-starting services:
# systemctl daemon-reload
# systemctl restart docker.service
# systemctl stop docker.service
# systemctl start docker.service
Well that is probably a good thing.
ls -l /var/run/docker.sock
ls -l /var/run/docker.sock
srw-rw----. 1 root docker 0 Sep 19 12:54 /var/run/docker.sock
This might be a bug in systemd...
Comment 8Lars Kellogg-Stedman
2014-09-30 19:30:57 UTC
I think this is the same as:
https://bugzilla.redhat.com/show_bug.cgi?id=1119282
systemd 208 does not support the SocketGroup directive, so it always creates the socket with root:root ownerhsip. On eric's system, running "chgrp docker /var/run/docker.sock" allowed a non-root user in the "docker" group to run docker.
Comment 9Lars Kellogg-Stedman
2014-09-30 19:34:56 UTC
Note that running "chgrp" is a temporary workaround, because every time the socket is restarted (e.g., on reboot), it will get re-created with the root:root permissions.
I have verified that lack of SocketGroup/SocketUser is the problem:
Sep 30 14:52:27 host.example.com systemd[1]: [/usr/lib/systemd/system/docker.socket:8] Unknown lvalue 'SocketGroup' in section 'Socket'
Comment 10Lars Kellogg-Stedman
2014-09-30 19:36:00 UTC
I am retargeting this bz to systemd.
Note that the systemd 208 packages in F20 already have the necessary support backported.