dind docker in docker , permission denied on /var/run/docker.sock

Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get http://%2Fvar%2Frun%2Fdocker.sock/v1.33/version: dial unix /var/run/docker.sock: connect: permission denied

ls -alh /var/run/docker.sock
srw-rw----. 1 root docker 0 Mar 11 15:45 /var/run/docker.sock


doing "chmod 777 /var/run/docker.sock" doesn't help


on the host:

docker version
Client:
Version: 1.12.6
API version: 1.24


in the container:

docker version
Client:
Version: 17.10.0-ce
API version: 1.33



The problem went away by installing on the host the latest docker version as per https://docs.docker.com/install/linux/docker-ce/centos/#install-using-the-convenience-script

SELinux

https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security-enhanced_linux/chap-security-enhanced_linux-introduction#sect-Security-Enhanced_Linux-Introduction-Benefits_of_running_SELinux


Priceless wiki https://wiki.centos.org/HowTos/SELinux

#disable DAC (must be root), will only log rule violations
setenforce 0
#enable it
setenforce 1
#check
getenforce

#display info
sestatus
cat /etc/selinux/config

DAC and MAC (discretionary and mandatory access control). First DAC is applied, then MAC (if DAC succeeds).
#list user, role, type, level
ls -Z myfile


Access Vector Cache (AVC)

#view SELinux-Linux user mappings
semanage login -l

#view the SELinux context for processes
ps -eZ


#view SELinux context associated to your user
id -Z

#label a file with a type (transient)
chcon -t

#permanent relabeling of file
semanage

#restore default context for process
restorecon


In Apache, if you get this:

[Tue Feb 27 14:11:52.105495 2018] [core:error] [pid 41356] (13)Permission denied: [client 1.2.3.4:55713] AH00035: access to /index.html denied (filesystem path '/path/to/home') because search permissions are missing on a component of the path

try

ps -efZ | grep http


and check the httpd process, on which TYPE (httpd_t) it's running:

system_u:system_r:httpd_t:s0 root 37203 1 0 Feb28 ? 00:00:03 /usr/sbin/httpd -DFOREGROUND
system_u:system_r:httpd_t:s0 apache 37206 37203 0 Feb28 ? 00:00:00 /usr/sbin/httpd -DFOREGROUND


then you have to change the type of your file to be served

ls -Z /path/to/index.html
-rw-r--r--. admrun admrun unconfined_u:object_r:default_t:s0 /path/to/index.html

then you do

chcon -t httpd_t /path/to/index.html

if you get

chcon: failed to change context of "/path/to/myfile" to "˜unconfined_u:object_r:httpd_t:s": Permission denied

it's because httpd_t is a PROCESS type, not a FILE type ( see http://danwalsh.livejournal.com/54803.html )


see here https://linux.die.net/man/8/httpd_selinux complete documentation of types


However it's better to change the context for the folder rather than for the individual files:


# semanage fcontext -a -t httpd_sys_content_t "/path/to(/.*)?"
# restorecon -R -v /path/to




see also "man semanage-fcontext" and https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security-enhanced_linux/sect-security-enhanced_linux-selinux_contexts_labeling_files-persistent_changes_semanage_fcontext


in Puppet (pueah) you can use https://github.com/voxpupuli/puppet-selinux and a clause like:


selinux::fcontext { '/path/to':
path => '/path/to(/.*)?',
setype => 'httpd_sys_content_t',
}

Apache!

Docs http://httpd.apache.org/docs/2.4/

Docker image https://hub.docker.com/_/httpd/

mkdir myapp
cd myapp
docker run -dit --name my-apache-app -p 8080:80 httpd:2.4

http://localhost:8080/index.html should display "it works"


To install on Centos7:
sudo yum update
sudo yum install httpd
sudo systemctl start httpd.service
sudo systemctl enable httpd.service

and configuration file is /etc/httpd/conf/httpd.conf, files in /var/www/html/
sudo chmod 777 /var/www/html/
vi /var/www/html/index.html
http://localhost:80

Directives docs http://httpd.apache.org/docs/2.4/mod/directives.html

Virtualhost directive http://httpd.apache.org/docs/2.4/mod/core.html#virtualhost



Interesting article on Nginx vs Apache https://poweruphosting.com/blog/apache-vs-nginx/


To debug:
/usr/sbin/httpd -t
/usr/sbin/httpd -t -f /u01/app/mware/httpd/conf/jboss.conf
/usr/sbin/httpd -e debug
/usr/sbin/httpd -M
/usr/sbin/httpd -S (Priceless! to dump current configuration)