4 ms·
It should be noted that some of the reports talk about the Docker API being publicly accessible over the internet which allowed people to run containers on thei
by cyphar 8y ago
It should be noted that some of the reports talk about the Docker API being publicly accessible over the internet which allowed people to run containers on their machines. This is actually not the worst thing that could have happened -- having access to the Docker API gives you root access on that machine without any authentication!
(One of the ideas of rootless containers is to remove the possibility of any privileged codepath, which helps eliminate this issue.)
- avip 8y agoDocker api exposed over internet without TLS implies a head should be removed. That’s not the default config. Not what the docs recommend. Why??
- djsumdog 8y agoI don't think that's even possible. Docker doesn't let you expose the daemon over HTTP without configuring certs. I had to write an ansible script to do that, and even then I locked down my Docker port to my VPN subnet: https://github.com/sumdog/bee2/blob/master/ansible/roles/docker/tasks/servertls.yml https://github.com/sumdog/bee2/blob/master/ansible/roles/doc...
- toopsss 8y agoWhat the heck are you talking about? If dockerd is started in tcp mode, it is unencrypted and unauthenticated by default.
- cyphar 8y agosudo dockerd -H tcp://0.0.0.0:8080 will happily start Docker with it listening on my IP address without TLS. It will print an all-caps warning, but nothing else (you don't even need to pass a --give-the-internet-root-access flag). However, I just submitted a PR which adds the --give-the-internet-root-access flag[1] because it's pretty obvious to me that very few users do this intentionally (and with full knowledge of the consequences). [1]: https://github.com/moby/moby/pull/37299 https://github.com/moby/moby/pull/37299