search

openshift / ocm-container

Containerized environment for accessing OpenShift v4 clusters, packing necessary tools/scripts
Apache License 2.0
10 stars 63 forks source link

Removes publish All by default and locks to localhost for port binding #279

Closed iamkirkbater closed 2 months ago

iamkirkbater commented 2 months ago

During some testing we realized that by using the --publish-all functionality we inadvertently open up the exposed port to all other hosts on our local networks, posing a potential security risk.

This changes that functionality so that by default it binds the console port to the local interface, so that you can only access the service running in ocm-container from your local machine and not other hosts on the network.

Effectively changes:

FROM:
42ba10b210d4  quay.io/app-sre/ocm-container:latest                        22 hours ago   Up 22 hours   0.0.0.0:43407->9999/tcp    dreamy_blackwell

TO:
5660b923b832  quay.io/app-sre/ocm-container:latest                        9 seconds ago  Up 9 seconds  127.0.0.1:35023->9999/tcp  intelligent_hoover

I ssh'd into another machine and curl'd my macbook and it served the contents running on port 43407 to my other machine. After changing the binding to the bottom example, my macbook replied with curl: (7) Failed to connect to 192.168.1.212 port 35023: Connection refused

As an architecture decision, I figured that it would be better to add a LocalPorts map to the ContainerRef so that we could optionally further expand the availability of ports in the future. For example, in some recent testing it would have been nice to have the ability to have a console running as well as the ability to port forward for PromLens; though that can come in a future PR.

clcollins commented 2 months ago

This looks great, thanks for talking through the changes with me. :shippit:

/lgtm /approve

openshift-ci[bot] commented 2 months ago

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: clcollins, iamkirkbater

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/openshift/ocm-container/blob/master/OWNERS)~~ [clcollins,iamkirkbater] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment