alpine linux can't run docker, docker socket permission denied

[cayspekko]

Hi I'm new to lima,
I decided to run alpine the alpine linux vm. Since containers/nerdctl doesn't seem to work yet with alpine I decided to install docker using sudo apk add docker, from the lima shell (just by running lima) everything installed fine and it's running but I can't issue a docker ps as it gives me permission denied. I tried adding my user to the docker group sudo addgroup $USER docker and seems okay but when I exit the lima shell and go back in I see my user is not part of the docker group when running group command. If I su $USER (after setting a password) and log in that way, it seems my user is part of the docker group and docker works fine. (same if I do a lima su username -c "docker ps")

Ideally I'd like to use lima docker ... to run docker commands but for some reason the shell user drops groups? Any way around this?

Thanks for the help, apologies for being new.

edit: changed useradd to addgroup

[jandubois]

I assume you meant addgroup instead of useradd.

The reason the new group is not reflected in ssh sessions is that limactl shell is not establishing a new session in the VM, but re-using a "master control socket". Running sudo inside the VM starts a new session, and the new group membership will be effective.

The easiest way to get around this is to stop and restart the VM. Then the new group assignment should work properly:

$ limactl shell alpine sudo addgroup $USER docker
$ limactl shell alpine id
uid=501(jan) gid=1000(jan) groups=1000(jan)
$ limactl stop alpine
[...]
$ limactl start alpine
[...]
$ limactl shell alpine id
uid=501(jan) gid=1000(jan) groups=101(docker),1000(jan)

[afbjorklund]

The regular docker yaml changes the user of the socket instead, as a workaround (to the group not taking effect until next shell)

It is a bit of a hack.

[cayspekko]

Thanks that works! Yes I meant addgroup not useradd thanks for picking up on that. Thanks also for the insight, it helps me understand better what's going on.

[jandubois]

I forgot to mention: since Alpine runs from an ISO image, you will have to re-run the sudo apk add docker command after each restart of the VM because changes outside of these directories are not persisted: /etc /home /root /tmp /usr/local /var/lib.

This reminds me that we should set up a package cache, so the packages don't have to be re-downloaded every time.

[cayspekko]

Yeah that was something I did notice when restarting. I'm coming from windows and used WSL quite a bit, so I'm use to that, but I see there are some important differences with lima. I wonder if it's possible to set up Alpine's lbu feature for persisting across shutdown/startup?

[jandubois]

I wonder if it's possible to set up Alpine's lbu feature for persisting across shutdown/startup?

I haven't tried it, but I don't know why it wouldn't work. However, I feel like just having a persisted package cache is more in line with how Lima handles Alpine otherwise (moving /etc /home /root /tmp /usr/local /var/lib all to the data volume).

That way you can install packages in a provisioning script (in your lima.yaml):

provision:
- mode: system
  script: |
    apk add docker

The first time it runs it will download and install docker, and keep all downloaded packages in the cache. On subsequent boots it will install the packages from the cache. This has pretty much the same effect as you get from putting them into an apkovl tarball.

I've created #1471 to setup the cache automatically.

If you want to use this right away, then something like this (untested) should work:

provision:
- mode: system
  script: |
    mkdir -p /etc/apk /mnt/data/apk/cache
    [ -e /etc/apk/cache ] || ln -s /mnt/data/apk/cache /etc/apk/cache
    apk add docker