4 ms·

No talk about permissions, I think locking down access is also an interesting aspect of Unix Domain Sockets compared to TCP sockets.

• Jhsto 5y ago
  As if the TCP is less secure? Not necessarily as the TCP sockets here most likely live in a private network between the two containers: you run `podman network create example` and then `podman run --net=example whatever`. This creates an internal network (e.g., 10.0.0.1/10) over which the pods communicate. Only if you want to expose some port would you use `-p` flag to expose it to host LAN, which you then redirect to WAN.
  • vageli 5y ago
    Not the person you responded to, but at the very least host processes can still access the internal network which may be undesired.
• orf 5y ago
  Seems irrelevant when running containers.
• tyingq 5y ago
  You can do some weird stuff with Unix Domain sockets, though, like using sendmsg() to pass over an open file descriptor.
• Arnavion 5y ago
  Indeed. You can use filesystem permissions to lock the socket down, and do client auth via the PID and/or UID of the client process instead of at the HTTP layer. For example you can assert that the client is from the Docker container that it's claiming to be from, by checking that its PID is in the list of PIDs in that container. Of course this also requires some discipline from the user, like not running containers as root, and not running containers with Docker socket access (which is as good as having root).