Restricted use of sudo for containerlab

[pierrehenrymuller]

Hi,

I would like to allow the use of containerlab for non root user who's not allowed to run all command with sudo.

I have put this in /etc/sudoers.d without success :

user ALL=(ALL:ALL) NOPASSWD: /usr/bin/containerlab

When user on Fedora34 run the exemple topology they have :

containerlab deploy --topo srlceos01.clab.yml

Error: containerlab requires sudo privileges to run

Containerlab was installed with latest rpm available :

containerlab version

                           _                   _       _     
                 _        (_)                 | |     | |    
 ____ ___  ____ | |_  ____ _ ____   ____  ____| | ____| | _  
/ ___) _ \|  _ \|  _)/ _  | |  _ \ / _  )/ ___) |/ _  | || \ 
( (__| |_|| | | | |_( ( | | | | | ( (/ /| |   | ( ( | | |_) )
\____)___/|_| |_|\___)_||_|_|_| |_|\____)_|   |_|\_||_|____/ 

    version: 0.19.2
     commit: 6122e22
       date: 2021-10-25T10:43:31Z
     source: https://github.com/srl-labs/containerlab
 rel. notes: https://containerlab.srlinux.dev/rn/0.19/#0192

There is other binaries to allow in sudoers to make available containerlab for standard user? For information the user have docker rootless installed in it's home with kernel userremap enabled and set in /etc/subuid and /etc/subgid.

Thanks

[hellt]

Hi @pierrehenrymuller can your user run sudo id and check which user id is returned?

containerlab uses a system call to get the user id to identify if it is run with sudo privileves, and if uid is not 0 as reported back by os.Geteuid() then containerlab emits that error

[pierrehenrymuller]

I had not authorized the id command. I have add the id to sudoers like this :

user ALL=(ALL:ALL) NOPASSWD: /usr/bin/containerlab                                                                                                        
user ALL=(ALL:ALL) NOPASSWD: /usr/bin/id

when I run the id allow to bypass root verification but now I have this :

sudo containerlab deploy --topo srlceos01.clab.yml                                                                                                  1 ⨯
WARN[0000] Error occurred during getting the default docker MTU: could not lookup "docker0": Link not found 
INFO[0000] Parsing & checking topology file: srlceos01.clab.yml 
Error: could not list containers: Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?

It seem that containerlab not read the DOCKER_HOST env variable, my docker rootless works fine and my env is set to :

printenv | grep DOCKER
DOCKER_HOST=unix:///run/user/1000/docker.sock

docker run hello-world

Hello from Docker!

Is containerlab compatible with docker rootless?

[hellt]

It hasn't been ever validated. But if it's only a matter of using another socket (as opposed to the standard, then it should be possible to implement

On Tue, 26 Oct 2021 at 11:53, Pierre-Henry Muller @.***> wrote:

I had not authorized the id command. I have add the id to sudoers like this :

user ALL=(ALL:ALL) NOPASSWD: /usr/bin/containerlab

user ALL=(ALL:ALL) NOPASSWD: /usr/bin/id

when I run the id allow to bypass root verification but now I have this :

sudo containerlab deploy --topo srlceos01.clab.yml 1 ⨯

WARN[0000] Error occurred during getting the default docker MTU: could not lookup "docker0": Link not found

INFO[0000] Parsing & checking topology file: srlceos01.clab.yml

Error: could not list containers: Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?

It seem that containerlab not read the DOCKER_HOST env variable, my docker rootless works fine and my env is set to :

printenv | grep DOCKER

DOCKER_HOST=unix:///run/user/1000/docker.sock

docker run hello-world

Hello from Docker!

Is containerlab compatible with docker rootless?

— You are receiving this because you commented.

Reply to this email directly, view it on GitHub https://github.com/srl-labs/containerlab/issues/669#issuecomment-951772918, or unsubscribe https://github.com/notifications/unsubscribe-auth/ABLKV5KUIXX2IWJPNAJLNXDUI2CAZANCNFSM5GVP3V5Q .

[LimeHat]

sudo containerlab deploy --topo srlceos01.clab.yml                                                                                                  1 ⨯
Error: could not list containers: Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?

It seem that containerlab not read the DOCKER_HOST env variable

You need to use sudo -E to preserve env vars.

[hellt]

closing due to inactivity

[q2dg]

Maybe with podman support, containerlab doesn't need to be run as root finally?

[mahmutaydin1]

sudo containerlab deploy --topo srlceos01.clab.yml                                                                                                  1 ⨯
Error: could not list containers: Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?

It seem that containerlab not read the DOCKER_HOST env variable

You need to use sudo -E to preserve env vars.

it worked on me