How to pass docker.sock to your containers while keeping security
1–6 of 6 posts
Re: How to pass docker.sock to your containers while keeping security
#2This is a great idea, I've always been wary of mounting docker.sock into a container. Does a read only mount make any difference I wonder?
Re: How to pass docker.sock to your containers while keeping security
#3This is a great idea, I've always been wary of mounting docker.sock into a container. Does a read only mount make any difference I wonder?
In thise case, you can't use a read only mount. The underlying protocol is HTTP, which means you must write a request to the socket to get a response. You can use read only mounts for `/proc` however, which just spits out data. I use it for titpetric/netdata for example.
Re: How to pass docker.sock to your containers while keeping security
#4This is a great idea, I've always been wary of mounting docker.sock into a container. Does a read only mount make any difference I wonder?
In thise case, you can't use a read only mount. The underlying protocol is HTTP, which means you must write a request to the socket to get a response. You can use read only mounts for `/proc` however, which just spits out data. I use it for titpetric/netdata for example.
This is wrong, I use read-only mounts for Unix sockets all the time. Such mount does not prevent reading-writing to the socket. What the read-only mount prevents is modification of meta-information for the socket file like changing ownership or permissions or ability to delete it.
Re: How to pass docker.sock to your containers while keeping security
#5This is a great idea, I've always been wary of mounting docker.sock into a container. Does a read only mount make any difference I wonder?
From security point of view there is little practical differences. The container can still communicate with docker normally and trivially become a root on the host. What it prevents is altering ownership and permissions of the socket.
Re: How to pass docker.sock to your containers while keeping security
#6This is a great idea, I've always been wary of mounting docker.sock into a container. Does a read only mount make any difference I wonder?
From security point of view there is little practical differences. The container can still communicate with docker normally and trivially become a root on the host. What it prevents is altering ownership and permissions of the socket.
Ah okay so thats why I see people using read only mount on a docker socket. that makes sense. Some how I never thought of that implication I was just thinking about how in the world a file descriptor permission would effect the http traffic as it travels over the socket, but obviously it doesn't.