4 ms·
This is very easily solved by using a proxy for the docker socket: https://github.com/Tecnativa/docker-socket-proxy https://github.com/Tecnativa/docker-socket-
by kayson 6y ago
This is very easily solved by using a proxy for the docker socket:
https://github.com/Tecnativa/docker-socket-proxy https://github.com/Tecnativa/docker-socket-proxy
https://github.com/traefik/traefik/issues/4174#issuecomment- https://github.com/traefik/traefik/issues/4174#issuecomment-
Create a private network that only connects Traefik and the proxy, and limit Traefik's access to only the GET requests it needs to operate. Now the socket is only exposed to a local container.
- imtringued 6y agoThis is such an obvious solution. I am seriously wondering why this isn't integrated into docker directly.
- codethief 6y agoThis just adds another layer of indirection. While it improves security, it is not the same as fixing the issue in the first place and making sure that no network-facing part of the system runs as root.