title: Run docker container via a setuid binary
body: <p>I am trying to set up a container on my (debian stretch) server, and to lock it down as much as possible.</p>
  
  <p>The container <code>my-container</code> only needs to be started, it then does some processing and returns (the whole thing takes about one second).</p>
  
  <p>I can easily do it as root with <code>docker start -a my-container</code>.</p>
  
  <p>My problem is that this processing needs to be triggered with a php script. Instead of giving www-data the right to start docker containers, I created a dedicated user, with a small setuid binary that executes the docker command.</p>
  
  <p>Now, executing the setuid binary from another user doesn't work and returns:</p>
  
  <pre><code>FATA[0000] Get http:///var/run/docker.sock/v1.18/containers/my-container/json: dial unix /var/run/docker.sock: permission denied. Are you trying to connect to a TLS-enabled daemon without TLS?
  </code></pre>
  
  <p>While executing the binary from the special user account works.</p>
  
  <p>I use <code>4510</code> permissions:</p>
  
  <pre><code>-r-s--x--- 1 docker-proxy-launcher another-user 8448 sept. 23 23:43 /home/docker-proxy-launcher/docker-prestage
  </code></pre>
  
  <p>The binary is a very simple program, derived from the <code>execve</code> man page:</p>
  
  <pre><code>#include &lt;unistd.h&gt;
  #include &lt;stdio.h&gt;
  #include &lt;stdlib.h&gt;
  #include &lt;unistd.h&gt;
  
  int main(int argc, char *argv[])
  {
  char *newenviron[] = { NULL };
  char * newargv[] = {NULL, "start", "-a", "my-container", NULL};
  char * exec="/usr/bin/docker";
  
  newargv[0] = exec;
  
  execve(exec, newargv, newenviron);
  perror("execve"); /* execve() only returns on error */
  exit(EXIT_FAILURE);
  }
  </code></pre>
  
  <p>I really don't get what is preventing me from launching the docker process with this setuid binary.</p>