[PR #189] feat: add Docker user allowlist for multi-user provisioning #157

New issue

Open

opened 2026-10-18 21:11:20 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-18 21:11:20 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-terminal/pull/189
Author: @decarvalhoaa
Created: 10/10/2026
Status: 🔄 Open

Base: main ← Head: feat/docker-allowed-users

📝 Commits (1)

2003241 feat: add Docker user allowlist for multi-user provisioning

📊 Changes

5 files changed (+144 additions, -1 deletions)

View changed files

📝 CHANGELOG.md (+6 -0)
📝 README.md (+10 -0)
📝 open_terminal/env.py (+15 -0)
📝 open_terminal/utils/user_isolation.py (+16 -1)
➕ tests/test_user_isolation.py (+97 -0)

📄 Description

Add an optional Docker user allowlist for multi-user mode

In multi-user mode, ensure_os_user() adds every newly provisioned user to the group that owns /var/run/docker.sock. With the socket mounted, every terminal user gets Docker access, and an operator who wants Docker for only some users has to patch the image.

This PR adds an optional setting:

OPEN_TERMINAL_DOCKER_ALLOWED_USERS=alice123,bob45678   # or docker_allowed_users in config.toml

Value	Behaviour
unset (default)	No change: every provisioned user joins the socket group
`user1,user2`	Only the listed Linux usernames join the group. Other users are provisioned normally, without it
empty	No provisioned user joins the group

Names are the final Linux usernames (after sanitize_username(), including OPEN_TERMINAL_USER_PREFIX), the same names shown in the provisioning logs.
The change only touches the existing group-assignment block in user_isolation.py and adds the setting to env.py. It adds no dependencies and does not change entrypoint.sh or the default behaviour.
The README notes that, like the rest of multi-user mode, this limits default access and is not a security boundary.

Tests

Adds tests/test_user_isolation.py (pytest is already in the dev group). It mocks the privileged calls and a fake socket, and covers: allowlist unset, an authorized user, an unauthorized user, several comma-separated users with whitespace, and an empty value. Without the change, 3 of the 5 tests fail. With it, all 5 pass. ruff check passes on the new test file.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-terminal/pull/189 **Author:** [@decarvalhoaa](https://github.com/decarvalhoaa) **Created:** 10/10/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `feat/docker-allowed-users` --- ### 📝 Commits (1) - [`2003241`](https://github.com/open-webui/open-terminal/commit/20032414efe0d327e79e759e719d9358dd3be295) feat: add Docker user allowlist for multi-user provisioning ### 📊 Changes **5 files changed** (+144 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `CHANGELOG.md` (+6 -0) 📝 `README.md` (+10 -0) 📝 `open_terminal/env.py` (+15 -0) 📝 `open_terminal/utils/user_isolation.py` (+16 -1) ➕ `tests/test_user_isolation.py` (+97 -0) </details> ### 📄 Description ## Add an optional Docker user allowlist for multi-user mode In multi-user mode, `ensure_os_user()` adds every newly provisioned user to the group that owns `/var/run/docker.sock`. With the socket mounted, every terminal user gets Docker access, and an operator who wants Docker for only some users has to patch the image. This PR adds an optional setting: ```bash OPEN_TERMINAL_DOCKER_ALLOWED_USERS=alice123,bob45678 # or docker_allowed_users in config.toml ``` | Value | Behaviour | |---|---| | unset (default) | No change: every provisioned user joins the socket group | | `user1,user2` | Only the listed Linux usernames join the group. Other users are provisioned normally, without it | | empty | No provisioned user joins the group | - Names are the final Linux usernames (after `sanitize_username()`, including `OPEN_TERMINAL_USER_PREFIX`), the same names shown in the provisioning logs. - The change only touches the existing group-assignment block in `user_isolation.py` and adds the setting to `env.py`. It adds no dependencies and does not change `entrypoint.sh` or the default behaviour. - The README notes that, like the rest of multi-user mode, this limits default access and is not a security boundary. ### Tests Adds `tests/test_user_isolation.py` (pytest is already in the `dev` group). It mocks the privileged calls and a fake socket, and covers: allowlist unset, an authorized user, an unauthorized user, several comma-separated users with whitespace, and an empty value. Without the change, 3 of the 5 tests fail. With it, all 5 pass. `ruff check` passes on the new test file. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-18 21:11:20 +00:00

No labels

bug

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

open-webui/open-terminal#157

No description provided.

Rows
Columns