Answers: <p>It's actually a bad idea to run Docker as root. What you should do instead is add the Jenkins user to the Docker group. <code>sudo usermod -aG docker jenkins</code>. That will avoid opening needless security holes and allow Jenkins to do all that it needs to do with Docker, including running as root inside the containers. I do this regularly with my builds, using this as a sample:</p>
  
  <pre><code>stage ('Build Docker Image') {
    steps {
      script {
        // Build the Docker image for compiling
        dockerImage = docker.build("myapp:v1")
      }
    }
  }
  stage ('Run UnitTests') {
    steps {
      script {
        dockerImage.inside("-itu root") {
          sh(script: "nosetests app-test.py --verbose")
        }
      }
    }
  }
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2018-11-16T14:39:52.827Z
Answers: 2018-12-12T14:59:00.357Z
Answers: 2018-12-12T14:59:00.357Z
Answers: primetheus
Answers: <p>So after a debug session in <a href="http://chat.stackexchange.com/rooms/56541/discussion-between-tensibai-and-tobassist">chat</a> what is needed is to allow the user running jenkins to be able to <code>sudo docker</code> passwordless on the docker host. </p>
  
  <p>A typical sudoers file on ubuntu could be in <code>/etc/sudoers.d/jenkins</code></p>
  
  <pre><code>jenkins_user ALL=(ALL) NOPASSWD:ALL
  </code></pre>
  
  <p>Be warned this allow <code>jenkins_user</code> to run as root without password any command, a better file should be:</p>
  
  <pre><code>jenkins_user ALL=(ALL) NOPASSWD:/full/path/to/docker
  jenkins_user ALL=(ALL) NOPASSWD:&lt;other needed command to be run as root&gt;
  </code></pre>
  
  <p>This will allow to start the container as root and as such it gives all rights within the container itself by running as uid 0.</p>
  
  <p>Useful resources used aside:</p>
  
  <ul>
  <li><a href="https://wiki.jenkins-ci.org/display/JENKINS/Docker+Plugin" rel="nofollow noreferrer">Jenkins docker plugin readme</a></li>
  <li><a href="https://serverfault.com/a/596988">How to setup passwordless <code>sudo</code> on Linux?</a></li>
  </ul>
  
Answers: CC BY-SA 3.0
Answers: 2017-04-04T13:58:54.170Z
Answers: 2017-04-04T14:01:25.980Z
Answers: 2017-04-13T12:14:55.217Z
Answers: Tensibai
Body: <p>I'm trying to get a new jenkins pipeline together to test new pull requests to our code. I'm using docker with the <code>ubuntu:14.04</code> image to simulate our production environment.</p>
  
  <p>Here is a minimum working example: </p>
  
  <pre><code>#jenkinsfile
  stage('Checkout and provision'){
  docker.image('ubuntu:14.04').withRun('-u root'){
      checkout scm
      sh 'chmod -R 770 ./'
      sh './init-script.sh'
      }
  }
  </code></pre>
  
  <p>and</p>
  
  <pre><code> #init-script.sh
   sudo add-apt-repository ppa:ondrej/php
   sudo apt-get update -y
   sudo apt-get dist-upgrade -y
   sudo apt-get install \
      apache2 \
      php \
      php-mysql \
      php-xml \
      libapache2-mod-auth-mysql \
      libapache2-mod-php \
      php5-curl \
      zip \
      htop \
      supervisor \
      mailutils \
      git \
      build-essential -y
   sudo apt-get autoremove -y
  </code></pre>
  
  <p>And the <code>/etc/sudoers</code> file for the container is as follow:</p>
  
  <pre><code>#
  # This file MUST be edited with the 'visudo' command as root.
  #
  # Please consider adding local content in /etc/sudoers.d/ instead of
  # directly modifying this file.
  #
  # See the man page for details on how to write a sudoers file.
  #
  Defaults        env_reset
  Defaults        mail_badpass
  Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
  Defaults:jenkins !requiretty
  
  # User alias specification
  
  # Cmnd alias specification
  
  # User privilege specification
  root    ALL=(ALL:ALL) ALL
  
  # Members of the admin group may gain root privileges
  %admin ALL=(ALL) ALL
  
  # Allow members of group sudo to execute any command
  %sudo   ALL=(ALL:ALL) ALL
  
  # See sudoers(5) for more information on "#include" directives:
  
  #includedir /etc/sudoers.d
  
  jenkins ALL=(ALL:ALL) NOPASSWD:ALL
  </code></pre>
  
  <p>The problem I'm having is that docker is not running as root as I'm used to and instead retaining the user id of the jenkins user from the host machine. This makes it difficult to sudo. </p>
  
  <p>I've tried adding the jenkins user to the containers <code>/etc/passwd</code> file and running <code>chmod</code> against that file but don't even have the permissions to do either of these from the <code>jenkinsfile</code>. </p>
  
  <p>With this configuration I should be the root user. However, I either see <code>Error: must run as root</code> if I don't use <code>sudo</code> or sudo: <code>no tty present and no askpass program specified</code> if I do.</p>
  
  <p>Is there a correct way to deal with this situation? Ideally from the <code>jenkinsfile</code>; I'd like to avoid creating an additional <code>Dockerfile</code> if possible as this will be a further differentiator between testing and production. </p>
  
Comments: CC BY-SA 3.0
Comments: 2017-04-03T20:22:14.750Z
Comments: Mind sharing your jenkinsfile and unit.sh ? Sounds mainly à guess at this point ...
Comments: Tensibai
Comments: CC BY-SA 3.0
Comments: 2017-04-04T05:49:18.810Z
Comments: This is sort of a stringy question trying to make people solve your homework. There are really jenkins forums for that kind of thing. Your question should really be asked in a form that can be found in a google search when having similar problem and be useful to someone other than yourself to be a good question for this site.
Comments: Jiri Klouda
Comments: CC BY-SA 3.0
Comments: 2017-04-04T08:41:54.857Z
Comments: I've been googling this for days and I've trawled the Jenkins docs. I'm yet to find a solution. If there is terminology that I'm missing to find the answers I need then please let me know. I've updated the question to make it clearer what I'm asking but I don't agree that this is 'stringy' or 'homework'.
Comments: tobassist
Comments: CC BY-SA 3.0
Comments: 2017-04-04T09:32:54.003Z
Comments: I've updated the question with a minimal example
Comments: tobassist
Comments: CC BY-SA 3.0
Comments: 2017-04-04T09:49:06.153Z
Comments: Maybe this can be of help: https://wiki.jenkins-ci.org/display/JENKINS/Docker+Plugin (I think -u root when you're not root doesn't work, it change the username but not the userid). You'll have to prepare your image with a jenkins user allowed to sudo passwordless.
Comments: Tensibai
Comments: CC BY-SA 3.0
Comments: 2017-04-04T11:30:06.367Z
Comments: Thanks for the link very helpful. I've got the slave image and removed the jenkins password but I'm still getting `sudo: no tty present and no askpass program specified`
Comments: tobassist
Comments: CC BY-SA 3.0
Comments: 2017-04-04T12:19:11.583Z
Comments: passwordless sudo is not removing a user password... it's configuring sudo to allow a user to type `sudo whatever` and not being asked for a password, more details here: http://serverfault.com/a/596988
Comments: Tensibai
Comments: CC BY-SA 3.0
Comments: 2017-04-04T13:38:57.317Z
Comments: I've updated the question with the sudoers file
Comments: tobassist
Comments: CC BY-SA 3.0
Comments: 2017-04-04T13:40:24.643Z
Comments: Did you remove the with(-u root) and is your jenkins instance running as jenkins user (and does this user exist on your docker host, but I assume it is local to the jenkins instance) ?
Comments: Tensibai
Comments: CC BY-SA 3.0
Comments: 2017-04-04T13:41:10.730Z
Comments: yes it's now withRun('-u jenkins')
Comments: tobassist
Comments: CC BY-SA 3.0
Comments: 2017-04-04T13:43:21.640Z
Comments: Let us [continue this discussion in chat](http://chat.stackexchange.com/rooms/56541/discussion-between-tensibai-and-tobassist).
Comments: Tensibai
Comments: CC BY-SA 3.0
Comments: 2017-04-04T15:49:03.527Z
Comments: After the recent edits I've retracted the close vote.
Comments: Jiri Klouda
Tags: <jenkins><docker>
Title: What are the correct permission settings when running Docker in a Jenkins Pipeline?
UserDisplayName: tobassist
ThreadText: # What are the correct permission settings when running Docker in a Jenkins Pipeline?
  
  (Asked by: username_0 on 2017-04-03)
  
  I'm trying to get a new jenkins pipeline together to test new pull requests to our code. I'm using docker with the `ubuntu:14.04` image to simulate our production environment.
  
  Here is a minimum working example:
  
  ```
  #jenkinsfile
  stage('Checkout and provision'){
  docker.image('ubuntu:14.04').withRun('-u root'){
      checkout scm
      sh 'chmod -R 770 ./'
      sh './init-script.sh'
      }
  }
  
  ```
  
  and
  
  ```
   #init-script.sh
   sudo add-apt-repository ppa:ondrej/php
   sudo apt-get update -y
   sudo apt-get dist-upgrade -y
   sudo apt-get install \
      apache2 \
      php \
      php-mysql \
      php-xml \
      libapache2-mod-auth-mysql \
      libapache2-mod-php \
      php5-curl \
      zip \
      htop \
      supervisor \
      mailutils \
      git \
      build-essential -y
   sudo apt-get autoremove -y
  
  ```
  
  And the `/etc/sudoers` file for the container is as follow:
  
  ```
  #
  # This file MUST be edited with the 'visudo' command as root.
  #
  # Please consider adding local content in /etc/sudoers.d/ instead of
  # directly modifying this file.
  #
  # See the man page for details on how to write a sudoers file.
  #
  Defaults        env_reset
  Defaults        mail_badpass
  Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
  Defaults:jenkins !requiretty
  
  # User alias specification
  
  # Cmnd alias specification
  
  # User privilege specification
  root    ALL=(ALL:ALL) ALL
  
  # Members of the admin group may gain root privileges
  %admin ALL=(ALL) ALL
  
  # Allow members of group sudo to execute any command
  %sudo   ALL=(ALL:ALL) ALL
  
  # See sudoers(5) for more information on "#include" directives:
  
  #includedir /etc/sudoers.d
  
  jenkins ALL=(ALL:ALL) NOPASSWD:ALL
  
  ```
  
  The problem I'm having is that docker is not running as root as I'm used to and instead retaining the user id of the jenkins user from the host machine. This makes it difficult to sudo.
  
  I've tried adding the jenkins user to the containers `/etc/passwd` file and running `chmod` against that file but don't even have the permissions to do either of these from the `jenkinsfile`.
  
  With this configuration I should be the root user. However, I either see `Error: must run as root` if I don't use `sudo` or sudo: `no tty present and no askpass program specified` if I do.
  
  Is there a correct way to deal with this situation? Ideally from the `jenkinsfile`; I'd like to avoid creating an additional `Dockerfile` if possible as this will be a further differentiator between testing and production.
  
  **Tags:** jenkins, docker
  
  > **Comments:**
  > **username_1**: Mind sharing your jenkinsfile and unit.sh ? Sounds mainly à guess at this point ...  
  > **username_2**: This is sort of a stringy question trying to make people solve your homework. There are really jenkins forums for that kind of thing. Your question should really be asked in a form that can be found in a google search when having similar problem and be useful to someone other than yourself to be a good question for this site.  
  > **username_0**: I've been googling this for days and I've trawled the Jenkins docs. I'm yet to find a solution. If there is terminology that I'm missing to find the answers I need then please let me know. I've updated the question to make it clearer what I'm asking but I don't agree that this is 'stringy' or 'homework'.  
  > **username_0**: I've updated the question with a minimal example  
  > **username_1**: Maybe this can be of help: https://wiki.jenkins-ci.org/display/JENKINS/Docker+Plugin (I think -u root when you're not root doesn't work, it change the username but not the userid). You'll have to prepare your image with a jenkins user allowed to sudo passwordless.  
  > **username_0**: Thanks for the link very helpful. I've got the slave image and removed the jenkins password but I'm still getting `sudo: no tty present and no askpass program specified`  
  > **username_1**: passwordless sudo is not removing a user password... it's configuring sudo to allow a user to type `sudo whatever` and not being asked for a password, more details here: http://serverfault.com/a/596988  
  > **username_0**: I've updated the question with the sudoers file  
  > **username_1**: Did you remove the with(-u root) and is your jenkins instance running as jenkins user (and does this user exist on your docker host, but I assume it is local to the jenkins instance) ?  
  > **username_0**: yes it's now withRun('-u jenkins')  
  > **username_1**: Let us [continue this discussion in chat](http://chat.stackexchange.com/rooms/56541/discussion-between-username_1-and-username_0).  
  > **username_2**: After the recent edits I've retracted the close vote.  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2017-04-04. Score: 12 | Accepted answer
  
  So after a debug session in [chat](http://chat.stackexchange.com/rooms/56541/discussion-between-username_1-and-username_0) what is needed is to allow the user running jenkins to be able to `sudo docker` passwordless on the docker host.
  
  A typical sudoers file on ubuntu could be in `/etc/sudoers.d/jenkins`
  
  ```
  jenkins_user ALL=(ALL) NOPASSWD:ALL
  
  ```
  
  Be warned this allow `jenkins_user` to run as root without password any command, a better file should be:
  
  ```
  jenkins_user ALL=(ALL) NOPASSWD:/full/path/to/docker
  jenkins_user ALL=(ALL) NOPASSWD:<other needed command to be run as root>
  
  ```
  
  This will allow to start the container as root and as such it gives all rights within the container itself by running as uid 0.
  
  Useful resources used aside:
  
  * [Jenkins docker plugin readme](https://wiki.jenkins-ci.org/display/JENKINS/Docker+Plugin)
  * [How to setup passwordless `sudo` on Linux?](https://serverfault.com/a/596988)
  
  
  ---
  
  ### Answer by username_3 on 2018-11-16. Score: 2
  
  It's actually a bad idea to run Docker as root. What you should do instead is add the Jenkins user to the Docker group. `sudo usermod -aG docker jenkins`. That will avoid opening needless security holes and allow Jenkins to do all that it needs to do with Docker, including running as root inside the containers. I do this regularly with my builds, using this as a sample:
  
  ```
  stage ('Build Docker Image') {
    steps {
      script {
        // Build the Docker image for compiling
        dockerImage = docker.build("myapp:v1")
      }
    }
  }
  stage ('Run UnitTests') {
    steps {
      script {
        dockerImage.inside("-itu root") {
          sh(script: "nosetests app-test.py --verbose")
        }
      }
    }
  }
  
  ```
  
  
  ---
  
  