SEC: read-only Docker socket (w/ haproxy) #52

westurner · 2020-12-28T15:34:04Z

From "ENH,SEC: Create additional sockets with limited permissions" moby/moby#38879 ::

An example use case: securing the Traefik docker driver:

"Docker integration: Exposing Docker socket to Traefik container is a serious security risk" Docker integration: Exposing Docker socket to Traefik container is a serious security risk traefik/traefik#4174 (comment)

It seems it only require (read) operations : ServerVersion, ContainerList, ContainerInspect, ServiceList, NetworkList, TaskList & Events.

https://github.com/liquidat/ansible-role-traefik

This role does exactly that: it launches two containers, a traefik one and another to securely provide limited access to the docker socket. It also provides the necessary configuration.

What could docker do to make it easier to do this correctly? Tecnativa/docker-socket-proxy#13

Creates a HAproxy container that proxies limited access to the docket socket

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

SEC: read-only Docker socket (w/ haproxy) #52

SEC: read-only Docker socket (w/ haproxy) #52

SEC: read-only Docker socket (w/ haproxy) #52

SEC: read-only Docker socket (w/ haproxy) #52

Comments