5 ms·

Somewhat related, since this is about Docker security: I started looking at Traefik today. It's a reverse proxy that runs as a Docker container and automagica

Somewhat related, since this is about Docker security: I started looking at Traefik today. It's a reverse proxy that runs as a Docker container and automagically configures itself to expose your other services (that are also running in Docker containers). Neat idea. However, to accomplish this you have to mount the docker socket into Traefik's container... Which means that when a bug shows up in Traefik attackers can pivot out of the container and onto the host; access to the docker socket is equivalent to root on the host. And of course Traefik is the thing you're exposing directly to the internet. It's like giving the guards outside manning your castle's gate the skeleton key to the rest of the castle. Of course, Traefik is quickly becoming popular because of its simplicity. But to achieve this simplicity it carves a giant hole in the security of your application.

gnur 8y ago
The integration of Traefik with the Docker daemon should mainly just be used while developing (imho). Once you get to acceptance / production environments, you are very unlikely to run plain docker containers, if you use kubernetes you interface Traefik with the kubernetes api itself, and the service account you create for Traefik can be (and should be) completely read only. Same for Docker Swarm, Marathon, Consul and AWS ECS. So no, Traefik is not the big security problem you make it out to be. Sorry to be so harsh, but Traefik is one of the most amazin pieces of software I have come across in the last years that has seriously made my life much easier.
- jakobegger 8y ago
  If software has an insecure mode "just for development" that absolutely shouldn't be used in production, you can be certain that a large fraction of developers will use that in production nevertheless. Security today doesn't mean that you are safe if you do everything according to best practices and follow the docs. Modern Security includes making sure that default settings are safe, and that it should be impossible or hard to set up the software in an insecure manner. If you make it easy to shoot yourself in the foot, that's what people will do.
  - raverbashing 8y ago
    > If you make it easy to shoot yourself in the foot, that's what people will do. Yes they will. Just repeating it here because it bears repeating. Yes, they don't care. And yes, there will be an attacker trying to exploit it.
  - heavenlyblue 8y ago
    Well, then let's allow the evolution take it's place.
  - gnur 8y ago
    To be fair, this is a limitation of Docker, there is nothing Traefik can do about it.
- nemothekid 8y ago
  If you use Traefik with Docker Swarm, the official docs[1] recommend you mount /var/run/docker.sock. Sure its not a problem if you use k8s, mesos, consul, or any of the other schedulers, but the security gap is still there. [1] https://docs.traefik.io/user-guide/swarm-mode/#deploy-trfik https://docs.traefik.io/user-guide/swarm-mode/#deploy-trfik
rollcat 8y ago
Two things... it's about time we've had an official permission system for the docker API, so I can grant "inspect running containers" and nothing else and sleep at night; two - it should be possible to run traefik in a pod as two containers - one talking to the API's and tweaking the runtime config, the other serving public traffic (jwilder/nginx-proxy can do this!). It's called privsep and OpenBSD have been doing it since forever - check their remote hole count, it's still two in a lifetime.
- CGamesPlay 8y ago
  jwilder/nginx-proxy has been instructing users to only grant read-only access to the docker daemon for as long as I've been using it, so I know this is at least possible. It's not fine-grained, but it is read-only access. https://github.com/jwilder/nginx-proxy https://github.com/jwilder/nginx-proxy
  - fpgaminer 8y ago
    According to this: https://raesene.github.io/blog/2016/03/06/The-Dangers-Of-Docker.sock/ https://raesene.github.io/blog/2016/03/06/The-Dangers-Of-Doc... mounting the socket readonly doesn't help.
    - CGamesPlay 8y ago
      Those are definitely good points. I'm curious about the part at the end: "An attacker with ro access to the socket can still create another container..." How is that possible with readonly socket access?
styfle 8y ago
A couple years ago, I wrote a container than periodically polls the Docker Socket to check for currently running containers with exposed ports and a special label applied. It then iterates over those containers and writes a nginx.conf file to a shared volume, then sends a SIGHUP signal to another container running nginx as a reverse proxy to the containers. The "polling job" container doesn't expose any ports and is not reachable from the outside world and the only input into this program is reading data from the Docker Socket. Do you think this is still vulnerable to attacks like Traefik is or does this 2-container routing protect against the attacks you're thinking of?
- fpgaminer 8y ago
  Very nice. Seems airtight to me. As others have suggested, Traefik should really be doing something similar (or Docker should add ACLs to its API).

gnur 8y ago

The integration of Traefik with the Docker daemon should mainly just be used while developing (imho). Once you get to acceptance / production environments, you are very unlikely to run plain docker containers, if you use kubernetes you interface Traefik with the kubernetes api itself, and the service account you create for Traefik can be (and should be) completely read only. Same for Docker Swarm, Marathon, Consul and AWS ECS. So no, Traefik is not the big security problem you make it out to be. Sorry to be so harsh, but Traefik is one of the most amazin pieces of software I have come across in the last years that has seriously made my life much easier.

jakobegger 8y ago
If software has an insecure mode "just for development" that absolutely shouldn't be used in production, you can be certain that a large fraction of developers will use that in production nevertheless. Security today doesn't mean that you are safe if you do everything according to best practices and follow the docs. Modern Security includes making sure that default settings are safe, and that it should be impossible or hard to set up the software in an insecure manner. If you make it easy to shoot yourself in the foot, that's what people will do.
- raverbashing 8y ago
  > If you make it easy to shoot yourself in the foot, that's what people will do. Yes they will. Just repeating it here because it bears repeating. Yes, they don't care. And yes, there will be an attacker trying to exploit it.
- heavenlyblue 8y ago
  Well, then let's allow the evolution take it's place.
- gnur 8y ago
  To be fair, this is a limitation of Docker, there is nothing Traefik can do about it.
nemothekid 8y ago
If you use Traefik with Docker Swarm, the official docs[1] recommend you mount /var/run/docker.sock. Sure its not a problem if you use k8s, mesos, consul, or any of the other schedulers, but the security gap is still there. [1] https://docs.traefik.io/user-guide/swarm-mode/#deploy-trfik https://docs.traefik.io/user-guide/swarm-mode/#deploy-trfik

rollcat 8y ago

Two things... it's about time we've had an official permission system for the docker API, so I can grant "inspect running containers" and nothing else and sleep at night; two - it should be possible to run traefik in a pod as two containers - one talking to the API's and tweaking the runtime config, the other serving public traffic (jwilder/nginx-proxy can do this!). It's called privsep and OpenBSD have been doing it since forever - check their remote hole count, it's still two in a lifetime.

CGamesPlay 8y ago
jwilder/nginx-proxy has been instructing users to only grant read-only access to the docker daemon for as long as I've been using it, so I know this is at least possible. It's not fine-grained, but it is read-only access. https://github.com/jwilder/nginx-proxy https://github.com/jwilder/nginx-proxy
- fpgaminer 8y ago
  According to this: https://raesene.github.io/blog/2016/03/06/The-Dangers-Of-Docker.sock/ https://raesene.github.io/blog/2016/03/06/The-Dangers-Of-Doc... mounting the socket readonly doesn't help.
  - CGamesPlay 8y ago
    Those are definitely good points. I'm curious about the part at the end: "An attacker with ro access to the socket can still create another container..." How is that possible with readonly socket access?

styfle 8y ago

A couple years ago, I wrote a container than periodically polls the Docker Socket to check for currently running containers with exposed ports and a special label applied. It then iterates over those containers and writes a nginx.conf file to a shared volume, then sends a SIGHUP signal to another container running nginx as a reverse proxy to the containers. The "polling job" container doesn't expose any ports and is not reachable from the outside world and the only input into this program is reading data from the Docker Socket. Do you think this is still vulnerable to attacks like Traefik is or does this 2-container routing protect against the attacks you're thinking of?

fpgaminer 8y ago
Very nice. Seems airtight to me. As others have suggested, Traefik should really be doing something similar (or Docker should add ACLs to its API).