加入“ Docker-users”的实际结果是什么。团体？
我将Windows 10 Home带有单独的管理员帐户，使用有限的帐户在日常工作中使用。我已经使用Admin帐户安装了Docker（社区版），但是当我切换到有限的用户时，除非我有限的帐户加入“ Docker-users”组，否则它不会让我运行它。
这个问题不是要问如何加入该组（请参阅此其他问题），而是要问为什么小组需要。这是安全措施吗？我是否通过使用有限帐户的Docker来打开漏洞？
如果不是安全措施，我将有什么原因拒绝该组的用户成员资格？
I use Windows 10 Home with a separate Admin account, using a limited account for day to day work. I've installed Docker (community edition) using the admin account, but when I switch to the limited user, it wouldn't let me run it unless my limited account joins the "docker-users" group.
This question isn't to ask how to join that group (see this other question) but instead to to ask why the group is needed. Is this a security measure? Do I open up a vulnerability by using Docker from a limited account?
If it isn't a security measure, what reasons would I have for denying a user membership of this group?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
能够创建 docker 容器应该被视为一种特权操作，因为它允许某人在底层服务器上托管新服务，包括在低编号端口（22、80、443 等）上托管接口。
“docker-users”组的存在是为了允许非管理员用户执行这些特权操作，绕过需要管理员用户的安全控制。这样做是为了方便标准用户而不是管理员用户管理 docker 容器。这样做的安全好处是，您可以进一步锁定您的管理员帐户，因为您不再需要不断访问它来进行 Docker 管理。缺点是“docker-users”组中任何帐户的泄露都可能导致整个 docker 环境受到泄露。
如果您是唯一使用您电脑的人，那么它不会产生太大影响，因为如果有人破坏您的帐户，无论如何您都会遇到更大的问题。在共享计算机环境中，您可能拥有一些有权使用 docker 的选定用户，但允许所有用户会显着增加您的攻击面，并且不允许任何用户意味着您必须为每个需要访问 docker 的用户提供特权帐户。
Being able to create docker containers should be considered a privileged action because it allows someone to host new services on the underlying server, including hosting interfaces on low-numbered ports (22, 80, 443 etc).
The "docker-users" group exists to allow non-admin users to perform these privileged actions, bypassing the security control that required an admin user. This exists for the convenience of managing docker containers from a standard user rather than an admin user. The security benefit of this is that you can further lock down your admin account as you no longer need to constantly access it for docker management. The downside is that the compromise of any account in the "docker-users" group could result in a compromise of your whole docker environment.
In the case where you are the only one using your PC, then it doesn't have much impact because if someone were to compromise your account, you would have bigger issues anyway. In shared computer environments, you may have some select users with the privilege to use docker, but allowing all user would significantly increase your attack surface, and allowing no users would mean you have to provide each user that requires access to docker with a privileged account.