3 ms·

Can't docker restrict incoming connections from a whitelist? Or you could use the system firewall to ensure that it does.

• tsimionescu 7y ago
  What do you mean by a white list? The connections are coming from local host (from your browser). The fact that they were initiated by code which was downloaded from malware.com is not knowable to docker.
  • zeusk 7y ago
    oh wait, you mean from client side javascript? I didn't know you could do that. FWIK, only WebSockets are supported within browsers - let me know if you know of a way otherwise.
    • DuskStar 7y ago
      I'm pretty sure you can make http POST and GET requests from client side JS, and again IIRC you can start a container in Docker with a single POST - no return info required
      • zeusk 7y ago
        Yes, but aren't HTTP requests subject to CORS? I'm pretty sure, otherwise, that is a gaping hole in many security setups right now - if any website could poke local sockets using client JS.
        • tsimionescu 7y ago
          CORS applies only to JS code - sites can still issue cross-origin GETs and POSTs via HTML, using Forms for example. Not sure whether there is enough control on the format to actually issue a valid Docker request. Still, it's generally a pretty bad idea to have an unauthenticated service running on localhost which can perform arbitrary operations on the system - you're depending on all other software running on the system not to transform that into a vulnerability.