buildkite sockguard issues

buildkite / sockguard

A proxy for docker.sock that enforces access control and isolated privileges

MIT License

143 stars 22 forks source link

issues

Newest

Newest Most commented Recently updated Oldest Least commented Least recently updated

Prefix all resources to avoid collisions

#60 CpuID opened 4 years ago
3
use of closed network connection

#59 CpuID opened 4 years ago
0
DELETE on Networks fails due to no owner?

#58 CpuID opened 4 years ago
1
Nathan - Hyphens in Volumes (Credit: Daniel Russell)

#57 CpuID closed 4 years ago
2
/container/create - HostConfig.Mounts not checked

#56 rwos opened 4 years ago
0
Fix Dockerfile

#55 AlekSi closed 4 years ago
1
/usr/bin/sockguard: line 1: syntax error near unexpected token `newline'

#54 ay-b closed 4 years ago
1
docs: suggest using only awk instead of 4 separate processes

#53 jirislav closed 5 years ago
1
README should contain disclaimer

#52 cyphar opened 5 years ago
2
Move sockguard cmd to cmd/sockguard

#51 lox closed 5 years ago
0
"POST /containers/{id}/attach"

#50 alobaidan opened 5 years ago
2
POST /containers/{id}/start (ownership check)

#49 alobaidan closed 5 years ago
4
Update docker to golang 1.11

#48 lox closed 5 years ago
0
fix: check volume ownership when binding

#47 jirislav closed 5 years ago
1
Testing for allowed bind volumes should be more strict

#46 jirislav closed 5 years ago
2
fix: it was possible to bind paths which were not allowed

#45 jirislav closed 5 years ago
2
Testing for allowed bind paths should be more strict

#44 jirislav closed 5 years ago
3
Add systemd example to README

#43 jirislav opened 5 years ago
3
fix: Docker build failed because of missing build dependency

#42 jirislav closed 5 years ago
4
Move to golang 1.11

#41 lox closed 5 years ago
1
Flush the buffer and close the connection after upstream does to allow interactive sessions

#40 lox closed 5 years ago
3
Namespacing?

#39 CpuID closed 5 years ago
2
Fix the way CgroupParent is handled with docker-compose

#38 CpuID closed 5 years ago
1
Add -docker-link + -container-join-network flags (always connect networks/containers to arbitrary container ID/name)

#37 CpuID closed 5 years ago
8
Apply CgroupParent to "docker build" operations

#36 CpuID closed 6 years ago
0
Disallow `--cgroup-parent` for API clients in "docker run" calls

#35 CpuID closed 6 years ago
0
More (complete) test coverage around checkOwner()

#34 CpuID closed 6 years ago
0
Test coverage around the containers part of checkOwner()

#33 CpuID closed 6 years ago
0
Clean up Docker publishing

#32 toolmantim closed 6 years ago
1
Add basic networks/create test coverage

#31 CpuID closed 6 years ago
0
handleContainerCreate Test Coverage

#30 CpuID closed 6 years ago
1
Implement BuildKit + Moby Support (by Docker CE 18.09 release)

#29 CpuID opened 6 years ago
1
examples/cgroup_parent: use builder Dockerfile again

#28 CpuID closed 6 years ago
0
Simplify logic around adding a label to filters

#27 lox closed 6 years ago
5
examples/cgroup_parent: change the ci_agent_dev Dockerfile to be more useful

#26 CpuID closed 6 years ago
0
"docker build" `/build` API operations are missing the owner label

#25 CpuID opened 6 years ago
3
Duplicate results in "docker-compose ps" operations

#24 CpuID closed 6 years ago
11
Apply CgroupParent to "docker build" operations

#23 CpuID closed 6 years ago
1
Allow to force user on created containers

#22 smaftoul closed 6 years ago
3
Allow multi-value, comma-delimited "--allow-bind" arg

#21 acmcelwee closed 6 years ago
1
enforcing in container user

#20 smaftoul closed 6 years ago
2
Add a minimal dockerfile

#19 lox closed 6 years ago
0
Fix networks regex

#18 CpuID closed 6 years ago
3
Adjust /containers/... identifier regex

#17 CpuID closed 6 years ago
1
"docker inspect" with prefixed ID format yields "Unable to find an identifier in ..."

#16 CpuID closed 6 years ago
2
"docker login"

#15 CpuID opened 6 years ago
2
bash wrapper example to README (for CgroupParent in ECS use case)

#14 CpuID closed 6 years ago
1
Disallow `--cgroup-parent` override for "docker run" calls

#13 CpuID closed 6 years ago
0
Generic Owner Label Name

#12 CpuID closed 6 years ago
8
Configurable Label Name + Optional CgroupParent as Label Value

#11 CpuID closed 6 years ago
25