Avoid giving admin privileges after restart on MacOS

[AlbertoFemenias]

Hi, after reading many issues and discussions in the repo, I start this new discussion seeking some help.

I work with a personal MacBook Air (M1, 2020, MacOS BigSur 11.6.4) and use rancher desktop 1.1.1 as my container manager. We would like to extend its use to all corporate computers but we have a big caveat, after each restart this prompt asks for root permissions:

The main problem is that workers with corporate Macs do not have admin credentials.
Is there a workaround to avoid giving sudo permissions on each restart?

Thanks in advance!

[jandubois]

The reason for the prompt is that macOS completely deletes the contents of /var/run on each reboot.

We are getting rid of /var/run/rancher-desktoplima in the next release for that reason. We are going to create the files directly inside the /var/run directory (with a rancher-desktop prefix in the filename) to avoid having to recreate the directory.

We have not yet implemented a way to create the docker socket in a user-owned location, so this will continue to prompt for sudo access unless you switch to containerd and nerdctl.

See also #1820 for some work-in-progress. It mentions the need for a followup PR to move the docker socket location. Unfortunately it looks like these changes will not yet make it into the next release (which has become urgent due to the recent breakage with macOS Monterey 12.3, e.g. #1815).

[jsfr]

Just to confirm, a version resolving this hasn't been released yet right?

[jandubois]

Just to confirm, a version resolving this hasn't been released yet right?

Depends on what you mean by "this", but yes, the status is still the same as described in #1814 (reply in thread).

If you need an externally routable IP address, or the docker socket in the default location, then you still need admin access, which means you will get prompted for your password once after each reboot.

Note that the vast majority of users don't have these requirements, so admin mode is no longer the default in Rancher Desktop.

[sebastianhaberey]

I am also suffering from this, it is really annoying to have to do this every day. I was thinking I need this for IntelliJ to connect to Rancher Desktop, as was suggested in this issue.

But @jandubois am I reading this right: without administrative access, Rancher Desktop would simply place the socket somewhere else? Where would that be - I'd like to try to reconfigure IntelliJ to that location and run RD without administrative access.

[jandubois]

Update This is kind of obsolete; please see me next comment below on how to configure the plugin.

You can check the location of the socket using docker context ls, e.g.

$ docker context ls
NAME                DESCRIPTION                               DOCKER ENDPOINT                                   ERROR
default             Current DOCKER_HOST based configuration   unix:///var/run/docker.sock
rancher-desktop *   Rancher Desktop moby context              unix:///Users/jan/.rd/docker.sock

Ideally IntelliJ should use the Docker context to determine the location of the socket, but I have no idea if it does.

An older mechanism to specify the location of the socket to client software is the DOCKER_HOST environment variable. This will also override the current context. See

$ DOCKER_HOST=unix:///hello/world docker context ls
NAME              DESCRIPTION                               DOCKER ENDPOINT                                   ERROR
default *         Current DOCKER_HOST based configuration   unix:///hello/world
rancher-desktop   Rancher Desktop moby context              unix:///Users/jan/.rd/docker.sock
Warning: DOCKER_HOST environment variable overrides the active context. To use a context, either set the global --context flag, or unset DOCKER_HOST environment variable.

Now rancher-desktop is not the active context anymore, and the endpoint for the default context has changed.

I don't know if IntelliJ would support the env variable either, but for desktop apps on macOS that would be hard to configure because the app is launched via launchd and does not inherit the user's shell environment settings.

[jandubois]

I assume the IntelliJ plugin is the same as the one for GoLand. I just tested it, and the "Docker for Mac" setting has a dropdown that lets you select a different context. Pick rancher-desktop here, and it should just work:

[sebastianhaberey]

@jandubois thanks for the thorough explanation! I was able to find the socket using docker context ls but like you said it wasn't even necessary because there was already an option for Rancher Desktop in IntelliJ:

Consequently I was able to disable administrative access permanently in the RD startup screen and use RD without the daily popup.