45 lines
1.7 KiB
Bash
Executable File
45 lines
1.7 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# blob:summary=Succeed when Docker needs sudo, fail when it can be used directly
|
|
# blob:args=[--configured]
|
|
# blob:examples=blob-sudo-docker && echo "needs sudo" | blob-sudo-docker --configured
|
|
# blob:hidden=true
|
|
|
|
# The docker group is root-equivalent, so Blob leaves users out of it by
|
|
# default and reaches the daemon through a prompt instead. Everything that has
|
|
# to make that choice asks here rather than testing group membership itself.
|
|
#
|
|
# Two questions, because they have different answers between toggling sudoless
|
|
# Docker and the reboot that applies it (group membership is fixed when the
|
|
# session is created):
|
|
#
|
|
# (default) Does Docker need sudo *right now*? Answered by whether this
|
|
# process can actually reach the socket, which is what decides
|
|
# if a command must elevate. Still true in the window after
|
|
# sudoless Docker is enabled but before the reboot.
|
|
# --configured Will it need sudo once the account's groups take effect?
|
|
# Answered from the account's configured groups, so the menu
|
|
# offers the toggle that can actually change state.
|
|
#
|
|
# Succeeds (exit 0) when sudo is needed, so it reads as `if blob-sudo-docker`.
|
|
|
|
DOCKER_SOCKET="${BLOB_DOCKER_SOCKET:-/var/run/docker.sock}"
|
|
|
|
case "${1:-}" in
|
|
--configured)
|
|
# An account in the docker group will not need sudo after the next login.
|
|
id -nG "$USER" 2>/dev/null | grep -qw docker && exit 1
|
|
exit 0
|
|
;;
|
|
"")
|
|
# A socket we can write is a daemon we can drive without elevating. A missing
|
|
# socket counts as needing sudo: reaching it means starting it as root anyway.
|
|
[[ -w $DOCKER_SOCKET ]] && exit 1
|
|
exit 0
|
|
;;
|
|
*)
|
|
echo "Usage: blob-sudo-docker [--configured]" >&2
|
|
exit 2
|
|
;;
|
|
esac
|