Allow Security Configuration of named pipe host

[laalkep]

Expected behavior

From a service user account

> docker version
Client:
 Version:       17.12.0-ce
 API version:   1.35
 Go version:    go1.9.2
 Git commit:    c97c6d6
 Built: Wed Dec 27 20:05:22 2017
 OS/Arch:       windows/amd64

Server:
 Engine:
  Version:      17.12.0-ce
  API version:  1.35 (minimum version 1.24)
  Go version:   go1.9.2
  Git commit:   c97c6d6
  Built:        Wed Dec 27 20:15:52 2017
  OS/Arch:      windows/amd64
  Experimental: true

Actual behavior

From a service user account

> docker version
error during connect: Get http://%2F%2F.%2Fpipe%2Fdocker_engine/v1.35/version: open
//./pipe/docker_engine: Access is denied. In the default daemon configuration on Windows,
the docker client must be run elevated to connect. This error may also indicate that the
docker daemon is not running.

Information

I think the simplest answer is to allow access to \\.\pipe\docker_engine to a dedicated group (docker-users)

At present the named pipe \\.\pipe\docker_engine receives a default ACL of

Allow - FullControl - NT AUTHORITY\SYSTEM
Allow - FullControl - BUILTIN\Administrators
Allow - Read, Write, Sync - _CURRENT_USER_

Steps to reproduce the behavior

1. Log on to windows desktop
2. Start powershell
3. docker version (you should receive the correct version information), this confirms that docker is running
4. Start-Process powershell.exe -Credential _UserAccountName_
5. Enter user's password in prompt
6. In new powershell...
7. docker version
8. Get error message described at top of post

[pgayvallet]

@kepboy Currently working on adding the group to the named pipe ACL.

Can you tell me how to simply display the current ACL for a given named pipe from PS ? Seems like Get-Acl does not play well with named pipes, and the documentation online is just plain dead on the subject.

[laalkep]

[System.IO.Directory]::GetAccessControl(“\\.\pipe\docker_engine”) Should do the trick

…

On Thu, 22 Feb 2018 at 20:24, Pierre Gayvallet ***@***.***> wrote: @kepboy <https://github.com/kepboy> Currently working on adding the group to the named pipe ACL. Can you tell me how to simply display the current ACL for a given named pipe from PS ? Seems like Get-Acl does not play well with named pipes, and the documentation online is just plain dead on the subject. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1732 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AKrA3vXZ25h9WJymRqftY1vu5DxMDmGYks5tXTIygaJpZM4SNDre> .

[pgayvallet]

Great, thanks

[laalkep]

I notice this fix is in the latest release, however, when I run docker the named pipe doesn't seem to have the docker-users group added to the ACL?

[CSEmbree]

I had this same issue @kepboy on 7.12.0.

18.03.0 works on an Admin seat on my Win10 but as a User I can't start the Docker service now. Unrelated (?) issue I suspect.

On 7.12.0 my process was: Install Docker (Admin), Assign a user to "docker-users" group (Admin), Log off admin account and log into user account (user) -> Start Docker for Windows service (user) -> Run docker's hello-world (user) -> Get the following error:

error during connect: Get http://%2F%2F.%2Fpipe%2Fdocker_engine/v1.35/version: open
//./pipe/docker_engine: Access is denied. In the default daemon configuration on Windows,
the docker client must be run elevated to connect. This error may also indicate that the
docker daemon is not running.

[CSEmbree]

A note: both 7.12.0 and 18.03.0 work on my home computer as a user or admin. Accounts just needs to be part of the "docker-users" group after Docker install by an Admin. Issues I am having are on a very locked down user account at work.

Home computer user (Docker for Windows v18.03.0):

PS C:\Users\user2> [System.IO.Directory]::GetAccessControl(“\\.\pipe\docker_engine”)

Path Owner                 Access
---- -----                 ------
     DESKTOP-K2E34GB\user2 NT AUTHORITY\SYSTEM Allow  FullControl...

will post/update what work computer gets from that command first thing tomorrow.

[laalkep]

I uninstalled and re-installed and it now appears to be working. I suspect the problem was related to the fact that I already had a group called docker-users on my computer and the upgrade didn't like it.

[CSEmbree]

Did a full uninstall remove the "docker-users" group? Was your previous install and upgrade? Strange but glad it's working for you @kepboy

[laalkep]

@CSEmbree I removed the old group myself prior to uninstall

[ebriney]

So is it fixed? Can we close the issue?

[asampal]

@ebriney could you please take a look at #1989 and offer any suggestions for what seems to be a related issue?

[docker-robott]

Closed issues are locked after 30 days of inactivity.
This helps our team focus on active issues.

If you have found a problem that seems similar to this, please open a new issue.

Send feedback to Docker Community Slack channels #docker-for-mac or #docker-for-windows.
/lifecycle locked