4 ms·
That is not the most secure way to run Docker in WSL - IIRC exposing the Docker socket on localhost lets websites start Docker containers. If you use something
by DuskStar 8y ago
That is not the most secure way to run Docker in WSL - IIRC exposing the Docker socket on localhost lets websites start Docker containers. If you use something like npiperelay [0], you can access Docker from WSL without exposing the Docker socket to everything.
0: https://github.com/jstarks/npiperelay https://github.com/jstarks/npiperelay
- zeusk 8y agoCan't docker restrict incoming connections from a whitelist? Or you could use the system firewall to ensure that it does.
- tsimionescu 8y agoWhat do you mean by a white list? The connections are coming from local host (from your browser). The fact that they were initiated by code which was downloaded from malware.com is not knowable to docker.
- zeusk 8y agooh wait, you mean from client side javascript? I didn't know you could do that. FWIK, only WebSockets are supported within browsers - let me know if you know of a way otherwise.
- DuskStar 8y agoI'm pretty sure you can make http POST and GET requests from client side JS, and again IIRC you can start a container in Docker with a single POST - no return info required
- zeusk 8y agoYes, but aren't HTTP requests subject to CORS? I'm pretty sure, otherwise, that is a gaping hole in many security setups right now - if any website could poke local sockets using client JS.
- tsimionescu 8y agoCORS applies only to JS code - sites can still issue cross-origin GETs and POSTs via HTML, using Forms for example. Not sure whether there is enough control on the format to actually issue a valid Docker request. Still, it's generally a pretty bad idea to have an unauthenticated service running on localhost which can perform arbitrary operations on the system - you're depending on all other software running on the system not to transform that into a vulnerability.