First, be aware that docker
is not designed to be securely shared among multiple users. Please assume that anyone who has access to docker
is effectively equivalent to `root'.
This assumes that users will be interacting with docker
via the command-line, rather than graphically. It also assumes that the environment is such that allows a single user to be automatically logged into via the GUI, but this is mostly out of laziness rather than an underlying technical restriction.
Choose an account that Docker Desktop will run as. I recommend creating a
docker
user, but it could be any account. This account does not need admin access.Open
Settings -> Users & Groups -> Login Options
, and ensure that this user is automatically logged into.Created a shared containers directory:
sudo mkdir -p /Users/Shared/Library/Containers
sudo chown docker:staff /Users/Shared/Library/Containers
sudo chmod -R 770 /Users/Shared/Library/Containers/
- Login graphically with the account that will run Docker and start
/Applications/Docker.app
, answer any questions it might have. - Open
Settings -> Users & Groups -> Login Items
, and drag theDocker
app to it. - Quit
Docker Desktop
via the menu item - Open
Terminal
and move your Docker data to a shared location that can be written to by other users:
mv ~/Library/Containers/com.docker.docker /Users/Shared/Library/Containers
chmod -R 770 /Users/Shared/Library/Containers/com.docker.docker
chmod -R +a "group:staff allow list,add_file,search,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity,file_inherit,directory_inherit" /Users/Shared/Library/Containers/com.docker.docker
chmod -R g+rw /Users/Shared/Library/Containers/com.docker.docker/Data
Then link your local Docker data to this shared source, and make sure that others can traverse into this folder to resolve the socket symlink:
ln -s /Users/Shared/Library/Containers/com.docker.docker ~/Library/Containers/com.docker.docker
chmod g+x ~/Library ~/Library/Containers
- Restart
/Applications/Docker.app
to test - SSH into the host as another username, and run
docker run mariadb
to test. - Reboot host and reconnect via ssh to test (it may take a moment for Docker to start up)
This is the configuration we use for the #kernelcafe. Please add your improvements to the comments!
Top comments (3)
thank you for these instructions. Have permissions changed in macOS Sonoma (14.6.1)?
I get an error while trying to move the Container directory:
docker@Embrace Containers % mv ~/Library/Containers/com.docker.docker /Users/Shared/Library/Containers
mv: rename /Users/docker/Library/Containers/com.docker.docker to /Users/Shared/Library/Containers/com.docker.docker: Operation not permitted
I had no problems moving all files in the directory manually but then I get stuck on the last step moving the offending directory out of the way to create a symlink even as root!
root@Embrace:/Users/docker/Library/Containers# mv com.docker.docker/ foo
mv: rename com.docker.docker/ to foo: Operation not permitted
Thanks for this guide! I have a question, does this work when running
docker-compose
? I'm getting writing errorsI don't see why it shouldn't work - what errors are you seeing? I could have easily missed a step.