ALLOW_RESTARTS doesn't work

Tecnativa / docker-socket-proxy

Proxy over your Docker socket to restrict which requests it accepts

Apache License 2.0

1.3k stars 156 forks source link

ALLOW_RESTARTS doesn't work #101

Open ThorpeJosh opened 9 months ago

ThorpeJosh commented 9 months ago

If I set the environment variable ALLOW_RESTARTS=1 then permission is still denied for any stop/restart/kill operation due to them all being POST methods (blocked by default).

If I set the environment variable POST=1 then stop/restart/kill operations work even if ALLOW_RESTARTS=0.

Is this a bug or is ALLOW_RESTARTS a depreciated configuration? It is not in the README.md but it is still in the haproxy.cfg.

JiggsNephron commented 8 months ago

Wondering the same here. I have to enable Post entirely even though all I need is restart. I was hoping to be able to be more granular by using ALLOW_RESTARTS=1 without POST=1.

raetha commented 6 months ago

I was looking at this same issue and it appears that the block for POST occurs in the rules before the allow statements for stop, start, and restart. That appears to be creating the situation where POST is still required since that rule is applied first. I believe the three new allow rules just need to be placed above the POST blocking rule and this should work as documented. Unfortunately it needs to be fixed in the repo, or you would need to build your own docker image. It isn't something that can be changed on the fly in the existing container image.