From 03518d3e18c68bc52085811f6ec37da8e98ce6e4 Mon Sep 17 00:00:00 2001
From: Christoph Lange <christoph@clange.de>
Date: Tue, 23 Apr 2024 20:08:58 +0200
Subject: [PATCH] DOC: in ssh forwarding, user git must be allowed to run
 docker (#29634)

Added to doc for rootless Docker installation: for SSH passthrough, the
ssh user (git) has to be able to run docker.

---------

Co-authored-by: techknowlogick <matti@mdranta.net>
---
 docs/content/installation/with-docker-rootless.en-us.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docs/content/installation/with-docker-rootless.en-us.md b/docs/content/installation/with-docker-rootless.en-us.md
index 10f1212217..5b59098f4c 100644
--- a/docs/content/installation/with-docker-rootless.en-us.md
+++ b/docs/content/installation/with-docker-rootless.en-us.md
@@ -350,6 +350,8 @@ Match User git
   AuthorizedKeysCommand /usr/bin/docker exec -i gitea /usr/local/bin/gitea keys -c /etc/gitea/app.ini -e git -u %u -t %t -k %k
 ```
 
+For this to work, the user `git` has to be allowed to run the `docker` cli command. Please read through the [security considerations](https://docs.docker.com/engine/security/#docker-daemon-attack-surface) of providing non-root linux users access to the docker daemon.
+
 (From 1.16.0 you will not need to set the `-c /etc/gitea/app.ini` option.)
 
 All that is left to do is restart the SSH server: