search

buildkite / sockguard

A proxy for docker.sock that enforces access control and isolated privileges
MIT License
143 stars 22 forks source link

/container/create - HostConfig.Mounts not checked #56

Open rwos opened 4 years ago

rwos commented 4 years ago

This came in with Docker API v1.25 (see https://docs.docker.com/engine/api/version-history/):

https://docs.docker.com/engine/api/v1.25/#operation/ContainerCreate

This can also create host bind-mounts, which are then not checked against the --allow-bind whitelist because sockguard only looks in HostConfig.Binds.