search

Tecnativa / docker-socket-proxy

Proxy over your Docker socket to restrict which requests it accepts
Apache License 2.0
1.41k stars 161 forks source link

exec / any other methods open when POST is set to 1 and how is DELETE handled ? #114

Open tobhv opened 8 months ago

tobhv commented 8 months ago

Hello,

just got started using this container to secure watchtower. but i see strange behavior when i send requests to the api in the below setup:

version: '2'
services:
  watchtower:
    environment:
      DOCKER_HOST: tcp://socket-proxy:2375
    image: ${MY_CONTAINER_REPO}containrrr/watchtower
    depends_on:
      - socket-proxy
    command: -R updatetest_updatetest_1
    restart: unless-stopped
  socket-proxy:
    image: ${MY_CONTAINER_REPO}tecnativa/docker-socket-proxy:edge
    environment:
      POST: 1
      CONTAINERS: 1
      IMAGES: 1
      NETWORKS: 1
      ALLOW_START: 1
      ALLOW_STOP: 1
      ALLOW_RESTARTS: 1
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro

this lets watchtower do its job nicely and the socket-proxy logs show clearly what requests have been done.

however, there is more: expected behavior:

actual behavior:

environment:

polarathene commented 2 weeks ago
  • a post request to exec is allowed!(bad)

That is because there is presently no difference between READ/WRITE, only enable/disable of an endpoint. While most exec operation belong to the /exec endpoint, this one belongs to /containers at /containers/{id}/exec thus the ENV is CONTAINERS=1 and it is a POST request thus POST=1 allows it:

    environment:
      POST: 1
      CONTAINERS: 1

https://github.com/Tecnativa/docker-socket-proxy/blob/0e8d6601b63652b623b964fa8e7c1d9edc2b12b1/haproxy.cfg#L56

https://github.com/Tecnativa/docker-socket-proxy/blob/0e8d6601b63652b623b964fa8e7c1d9edc2b12b1/haproxy.cfg#L59

https://github.com/Tecnativa/docker-socket-proxy/blob/0e8d6601b63652b623b964fa8e7c1d9edc2b12b1/haproxy.cfg#L48

There is a PR to run lua script to separate the read vs write permissions: https://github.com/Tecnativa/docker-socket-proxy/pull/126

If that lands you would have CONTAINERS_READ=1 and CONTAINERS_WRITE=0

Likewise due to the referenced rule with POST=1 check, while the name is poorly chosen, it allows any other request like DELETE to be permitted. Since you have CONTAINERS=1 that is granted. With that referenced PR CONTAINERS_WRITE=1 will enable both POST and DELETE requests, there is no further granularity there, although that should be sufficient for most needs.