Repository navigation
[Feature]: Add optional privilege elevation for the Docker provider (pkexec/sudo/doas) #732
Description
Before submitting
- I have searched existing issues and discussions to confirm this hasn't been requested
Problem or motivation
On native Linux systems, a rootful Docker daemon normally exposes a socket such as /var/run/docker.sock that is only accessible to root and members of the docker group.
As a result, Devsy's local Docker provider fails with a permission error when the current user is not a member of that group.
Adding a daily user to the docker group is not an acceptable solution for some security-conscious users, because access to the Docker daemon is effectively equivalent to persistent root access. Running the entire devsy process as root is also undesirable, since it can create root-owned files and grants much broader privileges than necessary.
Rootless Docker/Podman is an alternative, but it is not suitable for every environment or workload.
Proposed solution
Please add an optional, explicitly configured privilege-elevation mechanism to the Docker provider.
Alternatives considered
Devsy already supports configuring DOCKER_PATH, so I tried setting it to a wrapper script similar to:
#!/bin/sh
exec pkexec "$docker_bin" "$@"
The polkit authentication dialog did appear, which confirms that the wrapper was invoked. However:
- Multiple authentication dialogs appeared at once.
- Devsy reported that the operation had failed before I had completed password entry.
Area
CLI, Desktop app
Acceptance criteria
No response
Additional context
No response
Activity
skevetter commentedon Jul 24, 2026
Would you include:
sorubedo commentedon Jul 24, 2026
OS: VoidLinux
Devsy version: v1.6.1 appimage
logs (when use the pkexec wrapper script and desktop):
Are using the desktop or cli：desktop appimage
When using pkexec, before I even enter the password, devsy has already thrown this error and failed, and I noticed three polkit agent windows continuously looping, each trying to execute:
docker ps -q -a
docker --version
docker ps -q -a --filter label=dev.ccontainers.id=xxxxx
Maybe privilege escalation also requires permission caching? Otherwise, every time I open devsy desktop, I keep getting polkit dialogs asking for my password. This feels a bit complicated; it would be more convenient to just add the user to the docker group.