3 ms·
Two things... it's about time we've had an official permission system for the docker API, so I can grant "inspect running containers" and nothing else and sleep
by rollcat 8y ago
Two things... it's about time we've had an official permission system for the docker API, so I can grant "inspect running containers" and nothing else and sleep at night; two - it should be possible to run traefik in a pod as two containers - one talking to the API's and tweaking the runtime config, the other serving public traffic (jwilder/nginx-proxy can do this!). It's called privsep and OpenBSD have been doing it since forever - check their remote hole count, it's still two in a lifetime.
- CGamesPlay 8y agojwilder/nginx-proxy has been instructing users to only grant read-only access to the docker daemon for as long as I've been using it, so I know this is at least possible. It's not fine-grained, but it is read-only access. https://github.com/jwilder/nginx-proxy https://github.com/jwilder/nginx-proxy
- fpgaminer 8y agoAccording to this: https://raesene.github.io/blog/2016/03/06/The-Dangers-Of-Docker.sock/ https://raesene.github.io/blog/2016/03/06/The-Dangers-Of-Doc... mounting the socket readonly doesn't help.
- CGamesPlay 8y agoThose are definitely good points. I'm curious about the part at the end: "An attacker with ro access to the socket can still create another container..." How is that possible with readonly socket access?