<p>It's actually a bad idea to run Docker as root. What you should do instead is add the Jenkins user to the Docker group. <code>sudo usermod -aG docker jenkins</code>. That will avoid opening needless security holes and allow Jenkins to do all that it needs to do with Docker, including running as root inside the containers. I do this regularly with my builds, using this as a sample:</p>

<pre><code>stage ('Build Docker Image') {
  steps {
    script {
      // Build the Docker image for compiling
      dockerImage = docker.build("myapp:v1")
    }
  }
}
stage ('Run UnitTests') {
  steps {
    script {
      dockerImage.inside("-itu root") {
        sh(script: "nosetests app-test.py --verbose")
      }
    }
  }
}
</code></pre>

CC BY-SA 4.0
2018-11-16T14:39:52.827Z
2018-12-12T14:59:00.357Z
2018-12-12T14:59:00.357Z
primetheus
<p>So after a debug session in <a href="http://chat.stackexchange.com/rooms/56541/discussion-between-tensibai-and-tobassist">chat</a> what is needed is to allow the user running jenkins to be able to <code>sudo docker</code> passwordless on the docker host. </p>

<p>A typical sudoers file on ubuntu could be in <code>/etc/sudoers.d/jenkins</code></p>

<pre><code>jenkins_user ALL=(ALL) NOPASSWD:ALL
</code></pre>

<p>Be warned this allow <code>jenkins_user</code> to run as root without password any command, a better file should be:</p>

<pre><code>jenkins_user ALL=(ALL) NOPASSWD:/full/path/to/docker
jenkins_user ALL=(ALL) NOPASSWD:&lt;other needed command to be run as root&gt;
</code></pre>

<p>This will allow to start the container as root and as such it gives all rights within the container itself by running as uid 0.</p>

<p>Useful resources used aside:</p>

<ul>
<li><a href="https://wiki.jenkins-ci.org/display/JENKINS/Docker+Plugin" rel="nofollow noreferrer">Jenkins docker plugin readme</a></li>
<li><a href="https://serverfault.com/a/596988">How to setup passwordless <code>sudo</code> on Linux?</a></li>
</ul>

CC BY-SA 3.0
2017-04-04T13:58:54.170Z
2017-04-04T14:01:25.980Z
2017-04-13T12:14:55.217Z
Tensibai
<p>I'm trying to get a new jenkins pipeline together to test new pull requests to our code. I'm using docker with the <code>ubuntu:14.04</code> image to simulate our production environment.</p>

<p>Here is a minimum working example: </p>

<pre><code>#jenkinsfile
stage('Checkout and provision'){
docker.image('ubuntu:14.04').withRun('-u root'){
    checkout scm
    sh 'chmod -R 770 ./'
    sh './init-script.sh'
    }
}
</code></pre>

<p>and</p>

<pre><code> #init-script.sh
 sudo add-apt-repository ppa:ondrej/php
 sudo apt-get update -y
 sudo apt-get dist-upgrade -y
 sudo apt-get install \
    apache2 \
    php \
    php-mysql \
    php-xml \
    libapache2-mod-auth-mysql \
    libapache2-mod-php \
    php5-curl \
    zip \
    htop \
    supervisor \
    mailutils \
    git \
    build-essential -y
 sudo apt-get autoremove -y
</code></pre>

<p>And the <code>/etc/sudoers</code> file for the container is as follow:</p>

<pre><code>#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults        env_reset
Defaults        mail_badpass
Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
Defaults:jenkins !requiretty

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

jenkins ALL=(ALL:ALL) NOPASSWD:ALL
</code></pre>

<p>The problem I'm having is that docker is not running as root as I'm used to and instead retaining the user id of the jenkins user from the host machine. This makes it difficult to sudo. </p>

<p>I've tried adding the jenkins user to the containers <code>/etc/passwd</code> file and running <code>chmod</code> against that file but don't even have the permissions to do either of these from the <code>jenkinsfile</code>. </p>

<p>With this configuration I should be the root user. However, I either see <code>Error: must run as root</code> if I don't use <code>sudo</code> or sudo: <code>no tty present and no askpass program specified</code> if I do.</p>

<p>Is there a correct way to deal with this situation? Ideally from the <code>jenkinsfile</code>; I'd like to avoid creating an additional <code>Dockerfile</code> if possible as this will be a further differentiator between testing and production. </p>

CC BY-SA 3.0
2017-04-03T20:22:14.750Z
Mind sharing your jenkinsfile and unit.sh ? Sounds mainly à guess at this point ...
Tensibai
CC BY-SA 3.0
2017-04-04T05:49:18.810Z
This is sort of a stringy question trying to make people solve your homework. There are really jenkins forums for that kind of thing. Your question should really be asked in a form that can be found in a google search when having similar problem and be useful to someone other than yourself to be a good question for this site.
Jiri Klouda
CC BY-SA 3.0
2017-04-04T08:41:54.857Z
I've been googling this for days and I've trawled the Jenkins docs. I'm yet to find a solution. If there is terminology that I'm missing to find the answers I need then please let me know. I've updated the question to make it clearer what I'm asking but I don't agree that this is 'stringy' or 'homework'.
tobassist
CC BY-SA 3.0
2017-04-04T09:32:54.003Z
I've updated the question with a minimal example
tobassist
CC BY-SA 3.0
2017-04-04T09:49:06.153Z
Maybe this can be of help: https://wiki.jenkins-ci.org/display/JENKINS/Docker+Plugin (I think -u root when you're not root doesn't work, it change the username but not the userid). You'll have to prepare your image with a jenkins user allowed to sudo passwordless.
Tensibai
CC BY-SA 3.0
2017-04-04T11:30:06.367Z
Thanks for the link very helpful. I've got the slave image and removed the jenkins password but I'm still getting `sudo: no tty present and no askpass program specified`
tobassist
CC BY-SA 3.0
2017-04-04T12:19:11.583Z
passwordless sudo is not removing a user password... it's configuring sudo to allow a user to type `sudo whatever` and not being asked for a password, more details here: http://serverfault.com/a/596988
Tensibai
CC BY-SA 3.0
2017-04-04T13:38:57.317Z
I've updated the question with the sudoers file
tobassist
CC BY-SA 3.0
2017-04-04T13:40:24.643Z
Did you remove the with(-u root) and is your jenkins instance running as jenkins user (and does this user exist on your docker host, but I assume it is local to the jenkins instance) ?
Tensibai
CC BY-SA 3.0
2017-04-04T13:41:10.730Z
yes it's now withRun('-u jenkins')
tobassist
CC BY-SA 3.0
2017-04-04T13:43:21.640Z
Let us [continue this discussion in chat](http://chat.stackexchange.com/rooms/56541/discussion-between-tensibai-and-tobassist).
Tensibai
CC BY-SA 3.0
2017-04-04T15:49:03.527Z
After the recent edits I've retracted the close vote.
Jiri Klouda
<jenkins><docker>
What are the correct permission settings when running Docker in a Jenkins Pipeline?
tobassist
# What are the correct permission settings when running Docker in a Jenkins Pipeline?

(Asked by: username_0 on 2017-04-03)

I'm trying to get a new jenkins pipeline together to test new pull requests to our code. I'm using docker with the ubuntu:14.04 image to simulate our production environment.
Here is a minimum working example: 
#jenkinsfile
stage('Checkout and provision'){
docker.image('ubuntu:14.04').withRun('-u root'){
    checkout scm
    sh 'chmod -R 770 ./'
    sh './init-script.sh'
    }
}

and
 #init-script.sh
 sudo add-apt-repository ppa:ondrej/php
 sudo apt-get update -y
 sudo apt-get dist-upgrade -y
 sudo apt-get install \
    apache2 \
    php \
    php-mysql \
    php-xml \
    libapache2-mod-auth-mysql \
    libapache2-mod-php \
    php5-curl \
    zip \
    htop \
    supervisor \
    mailutils \
    git \
    build-essential -y
 sudo apt-get autoremove -y

And the /etc/sudoers file for the container is as follow:
#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults        env_reset
Defaults        mail_badpass
Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
Defaults:jenkins !requiretty

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

jenkins ALL=(ALL:ALL) NOPASSWD:ALL

The problem I'm having is that docker is not running as root as I'm used to and instead retaining the user id of the jenkins user from the host machine. This makes it difficult to sudo. 
I've tried adding the jenkins user to the containers /etc/passwd file and running chmod against that file but don't even have the permissions to do either of these from the jenkinsfile. 
With this configuration I should be the root user. However, I either see Error: must run as root if I don't use sudo or sudo: no tty present and no askpass program specified if I do.
Is there a correct way to deal with this situation? Ideally from the jenkinsfile; I'd like to avoid creating an additional Dockerfile if possible as this will be a further differentiator between testing and production.

**Tags:** jenkins, docker

> **Comments:**
> **username_1**: Mind sharing your jenkinsfile and unit.sh ? Sounds mainly à guess at this point ...  
> **username_2**: This is sort of a stringy question trying to make people solve your homework. There are really jenkins forums for that kind of thing. Your question should really be asked in a form that can be found in a google search when having similar problem and be useful to someone other than yourself to be a good question for this site.  
> **username_0**: I've been googling this for days and I've trawled the Jenkins docs. I'm yet to find a solution. If there is terminology that I'm missing to find the answers I need then please let me know. I've updated the question to make it clearer what I'm asking but I don't agree that this is 'stringy' or 'homework'.  
> **username_0**: I've updated the question with a minimal example  
> **username_1**: Maybe this can be of help: https://wiki.jenkins-ci.org/display/JENKINS/Docker+Plugin (I think -u root when you're not root doesn't work, it change the username but not the userid). You'll have to prepare your image with a jenkins user allowed to sudo passwordless.  
> **username_0**: Thanks for the link very helpful. I've got the slave image and removed the jenkins password but I'm still getting `sudo: no tty present and no askpass program specified`  
> **username_1**: passwordless sudo is not removing a user password... it's configuring sudo to allow a user to type `sudo whatever` and not being asked for a password, more details here: http://serverfault.com/a/596988  
> **username_0**: I've updated the question with the sudoers file  
> **username_1**: Did you remove the with(-u root) and is your jenkins instance running as jenkins user (and does this user exist on your docker host, but I assume it is local to the jenkins instance) ?  
> **username_0**: yes it's now withRun('-u jenkins')  
> **username_1**: Let us [continue this discussion in chat](http://chat.stackexchange.com/rooms/56541/discussion-between-tensibai-and-username_0).  
> **username_2**: After the recent edits I've retracted the close vote.  

---

## 2 answers

### Answer by username_1 on 2017-04-04. Score: 12 | Accepted answer

So after a debug session in chat what is needed is to allow the user running jenkins to be able to sudo docker passwordless on the docker host. 
A typical sudoers file on ubuntu could be in /etc/sudoers.d/jenkins
jenkins_user ALL=(ALL) NOPASSWD:ALL

Be warned this allow jenkins_user to run as root without password any command, a better file should be:
jenkins_user ALL=(ALL) NOPASSWD:/full/path/to/docker
jenkins_user ALL=(ALL) NOPASSWD:

This will allow to start the container as root and as such it gives all rights within the container itself by running as uid 0.
Useful resources used aside:

Jenkins docker plugin readme
How to setup passwordless sudo on Linux?


---

### Answer by username_3 on 2018-11-16. Score: 2

It's actually a bad idea to run Docker as root. What you should do instead is add the Jenkins user to the Docker group. sudo usermod -aG docker jenkins. That will avoid opening needless security holes and allow Jenkins to do all that it needs to do with Docker, including running as root inside the containers. I do this regularly with my builds, using this as a sample:
stage ('Build Docker Image') {
  steps {
    script {
      // Build the Docker image for compiling
      dockerImage = docker.build("myapp:v1")
    }
  }
}
stage ('Run UnitTests') {
  steps {
    script {
      dockerImage.inside("-itu root") {
        sh(script: "nosetests app-test.py --verbose")
      }
    }
  }
}


---

