4 ms·

I use WSL at work and use windows docker as a server... I use docker client form wsl ubuntu and make it connect to the Docker server running on windows. I do th

I use WSL at work and use windows docker as a server... I use docker client form wsl ubuntu and make it connect to the Docker server running on windows. I do the same thing with databases. I’ve grown fond of this approach, as it integrates well with the Services app in windows. https://nickjanetakis.com/blog/setting-up-docker-for-windows-and-wsl-to-work-flawlessly https://nickjanetakis.com/blog/setting-up-docker-for-windows...

DuskStar 7y ago
That is not the most secure way to run Docker in WSL - IIRC exposing the Docker socket on localhost lets websites start Docker containers. If you use something like npiperelay [0], you can access Docker from WSL without exposing the Docker socket to everything. 0: https://github.com/jstarks/npiperelay https://github.com/jstarks/npiperelay
- zeusk 7y ago
  Can't docker restrict incoming connections from a whitelist? Or you could use the system firewall to ensure that it does.
  - tsimionescu 7y ago
    What do you mean by a white list? The connections are coming from local host (from your browser). The fact that they were initiated by code which was downloaded from malware.com is not knowable to docker.
    - zeusk 7y ago
      oh wait, you mean from client side javascript? I didn't know you could do that. FWIK, only WebSockets are supported within browsers - let me know if you know of a way otherwise.
      - DuskStar 7y ago
        I'm pretty sure you can make http POST and GET requests from client side JS, and again IIRC you can start a container in Docker with a single POST - no return info required
        zeusk 7y ago
        Yes, but aren't HTTP requests subject to CORS? I'm pretty sure, otherwise, that is a gaping hole in many security setups right now - if any website could poke local sockets using client JS.
        tsimionescu 7y ago
        CORS applies only to JS code - sites can still issue cross-origin GETs and POSTs via HTML, using Forms for example. Not sure whether there is enough control on the format to actually issue a valid Docker request. Still, it's generally a pretty bad idea to have an unauthenticated service running on localhost which can perform arbitrary operations on the system - you're depending on all other software running on the system not to transform that into a vulnerability.

DuskStar 7y ago

That is not the most secure way to run Docker in WSL - IIRC exposing the Docker socket on localhost lets websites start Docker containers. If you use something like npiperelay [0], you can access Docker from WSL without exposing the Docker socket to everything. 0: https://github.com/jstarks/npiperelay https://github.com/jstarks/npiperelay

zeusk 7y ago
Can't docker restrict incoming connections from a whitelist? Or you could use the system firewall to ensure that it does.
- tsimionescu 7y ago
  What do you mean by a white list? The connections are coming from local host (from your browser). The fact that they were initiated by code which was downloaded from malware.com is not knowable to docker.
  - zeusk 7y ago
    oh wait, you mean from client side javascript? I didn't know you could do that. FWIK, only WebSockets are supported within browsers - let me know if you know of a way otherwise.
    - DuskStar 7y ago
      I'm pretty sure you can make http POST and GET requests from client side JS, and again IIRC you can start a container in Docker with a single POST - no return info required
      - zeusk 7y ago
        Yes, but aren't HTTP requests subject to CORS? I'm pretty sure, otherwise, that is a gaping hole in many security setups right now - if any website could poke local sockets using client JS.
        tsimionescu 7y ago
        CORS applies only to JS code - sites can still issue cross-origin GETs and POSTs via HTML, using Forms for example. Not sure whether there is enough control on the format to actually issue a valid Docker request. Still, it's generally a pretty bad idea to have an unauthenticated service running on localhost which can perform arbitrary operations on the system - you're depending on all other software running on the system not to transform that into a vulnerability.