4 ms·
jwilder/nginx-proxy has been instructing users to only grant read-only access to the docker daemon for as long as I've been using it, so I know this is at least
by CGamesPlay 8y ago
jwilder/nginx-proxy has been instructing users to only grant read-only access to the docker daemon for as long as I've been using it, so I know this is at least possible. It's not fine-grained, but it is read-only access. https://github.com/jwilder/nginx-proxy https://github.com/jwilder/nginx-proxy
- fpgaminer 8y agoAccording to this: https://raesene.github.io/blog/2016/03/06/The-Dangers-Of-Docker.sock/ https://raesene.github.io/blog/2016/03/06/The-Dangers-Of-Doc... mounting the socket readonly doesn't help.
- CGamesPlay 8y agoThose are definitely good points. I'm curious about the part at the end: "An attacker with ro access to the socket can still create another container..." How is that possible with readonly socket access?