小知识：将普通用户加入到docker组

新的OCI实例，OS选择的是OEL7.9，初始环境是没有安装docker的，我们可以直接使用yum安装，之后启动docker服务：

[opc@oci-001 ~]$ sudo yum install docker
[opc@oci-001 ~]$ sudo systemctl start docker

因为默认登陆用户是opc，安装后使用docker命令都需要sudo，否则会报错权限问题：

[opc@oci-001 ~]$ docker ps
Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.40/containers/json": dial unix /var/run/docker.sock: connect: permission denied
[opc@oci-001 ~]$ sudo docker ps
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES

为了操作方便，我们需要将opc用户加入到docker组中：

[opc@oci-001 run]$ sudo gpasswd -a opc docker
正在将用户“opc”加入到“docker”组中
[opc@oci-001 run]$ docker ps
Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.40/containers/json": dial unix /var/run/docker.sock: connect: permission denied
[opc@oci-001 run]$ id
uid=1000(opc) gid=1000(opc) 组=1000(opc),4(adm),10(wheel),190(systemd-journal) 环境=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
[opc@oci-001 run]$ id opc
uid=1000(opc) gid=1000(opc) 组=1000(opc),4(adm),10(wheel),190(systemd-journal),992(docker)
[opc@oci-001 run]$ id
uid=1000(opc) gid=1000(opc) 组=1000(opc),4(adm),10(wheel),190(systemd-journal) 环境=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

上面看到加入docker组后依然报错，但其实通过id和id opc验证很容易发现是当前shell没有生效，

此时需要重新登陆opc用户，再次尝试可以正常执行docker命令而无需sudo操作：

Enter your username: opc
Last login: Wed Nov 10 23:47:49 2021 from xxx.xxx.xxx.xxx
[opc@oci-001 ~]$ id
uid=1000(opc) gid=1000(opc) 组=1000(opc),4(adm),10(wheel),190(systemd-journal),992(docker) 环境=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
[opc@oci-001 ~]$ docker ps
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES
[opc@oci-001 ~]$ docker version
Client: Docker Engine - Community
 Version:           19.03.11-ol
 API version:       1.40
 Go version:        go1.16.2
 Git commit:        9bb540d
 Built:             Fri Jul 23 01:33:55 2021
 OS/Arch:           linux/amd64
 Experimental:      false

Server: Docker Engine - Community
 Engine:
  Version:          19.03.11-ol
  API version:      1.40 (minimum version 1.12)
  Go version:       go1.16.2
  Git commit:       9bb540d
  Built:            Fri Jul 23 01:32:08 2021
  OS/Arch:          linux/amd64
  Experimental:     false
  Default Registry: docker.io
 containerd:
  Version:          v1.4.8
  GitCommit:        7eba5930496d9bbe375fdf71603e610ad737d2b2
 runc:
  Version:          1.0.0-rc95
  GitCommit:        2856f01
 docker-init:
  Version:          0.18.0
  GitCommit:        fec3683

此时就可以正常操作docker命令了，但是还有一个情况，如果需要登陆需要登陆信息的docker镜像仓库，比如Oracle的官方镜像仓库：

[opc@oci-001 ~]$ docker login container-registry.oracle.com
Username: xxx@xx.com
Password:
WARNING! Your password will be stored unencrypted in /home/opc/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded

成功登陆后，可以正常拉取对应镜像：

[opc@oci-001 ~]$ docker pull container-registry.oracle.com/database/enterprise:19.3.0.0
Trying to pull repository container-registry.oracle.com/database/enterprise ...
19.3.0.0: Pulling from container-registry.oracle.com/database/enterprise
86607bb85307: Pull complete
9426f6bfa092: Pull complete
16f82e6c6196: Pull complete
3b3cb340bf3a: Pull complete
914616be8a89: Pull complete
72eda44db682: Pull complete
4f4fb700ef54: Pull complete
930126d48988: Pull complete
74776159d717: Pull complete
a75af7560303: Pull complete
768777aee4bd: Pull complete
83bc762e273b: Pull complete
40ae2cf39a7a: Pull complete
97f3b11e6fb5: Pull complete
49b970fb5707: Pull complete
49801e1d38a0: Pull complete
e0d849ef2418: Pull complete
31d732a7744f: Pull complete
760939c383f0: Pull complete
5c2969cb34b8: Pull complete
Digest: sha256:ea9cd805ec49368fd288323e3f41d6c6e45698813e2ae89fd5d097c026ab5aa6
Status: Downloaded newer image for container-registry.oracle.com/database/enterprise:19.3.0.0
container-registry.oracle.com/database/enterprise:19.3.0.0

注：之前做测试过程中，最开始没有将opc加入到docker组中，所以使用sudo操作，比如登陆用 sudo docker login方式登陆，配置文件会被存放到/root/.docker/config.json，给后面运维会带来一些麻烦。所以建议大家最开始就配置规划好使用docker的用户。