Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Feature: per-socket (per-instance) exec allowlist

Abierto
  • ¿Algo no está bien?
#65 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
25/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
go, rust, typescript
Área
backend, security

Línea de trabajo

Read the README's “Trust model,” issue #39, and the exec deny rules in #49; inspect the Go, Rust, and TypeScript implementations and spec/docker_socket_policy.qnt. The proposal leaves key policy decisions open, including command matching, container scope, exec-ID tracking, and fields to restrict, so this is design work rather than a bounded first contribution.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Type: Feature

Is your feature request related to a problem?

Exec is hard-coded as denied in all three implementations: POST /containers/<name>/exec and POST /exec/<id>/start. No policy or configuration can enable it. Some deployments may legitimately want callers of one socket to run a limited set of commands in their containers, for example a health or debug command, while other sockets stay locked down.

Today's model:

  • The trust boundary is the listening socket (see README "Trust model" and #39). Anyone who can connect gets everything that proxy instance allows. The proxy has no caller identity.
  • Policies are per service and are selected by image name only on POST /containers/create. Exec requests carry no image, so a policy cannot be selected for them.

So "per socket" means per proxy instance.

Describe the solution (for future consideration; not designed yet)

An instance-level setting, as a flag or a config file next to the policies, that allows exec under explicit limits. Open questions:

  • Command allowlist, matched on Cmd in the exec-create body, using the same flag/value-pattern machinery as CmdGate. Is a plain on/off switch ever acceptable?
  • Container scope: restrict to containers created from images matching a policy's allowed_image_prefixes, or to named containers. This needs the daemon's container-to-image mapping at exec time.
  • Fields to force or deny: Privileged: true (always deny?), User (force it?), Env, Tty/AttachStdin.
  • POST /exec/<id>/start, /resize, and GET /exec/<id>/json: start can only be allowed for exec instances this proxy created and approved, which means tracking exec IDs. Inspect leaks other users' exec command lines (verified in #49: ExecIDs from container inspect, then GET /exec/<id>/json, shows the full arguments including inline secrets).
  • Spec: a new invariant in spec/docker_socket_policy.qnt, replacing "execContainer unconditionally returns false", such as "every executed command matches the instance allowlist".
  • Audit: log every exec create and start, with the command.

Describe alternatives

  • Keep exec denied everywhere (status quo). Simplest and safest. Users who need exec use the daemon socket directly, outside the proxy's guarantees.
  • Per-policy setting. Not workable: exec requests carry no image, so there is no policy to select (see above).
  • Per-caller identity. Rejected by the #39 trust model.

Which implementation(s) would this affect?

  • All (Go, Rust, TypeScript, Quint specification)

Additional context

Raised while converging the exec deny rules in #49. #49 keeps exec denied and only fixes the cross-language differences.

Lenguaje dominante
Rust
Estrellas
2
Forks
0
Merge medio
13 h 22 min
PR fusionados (30 d)
27

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de ChainSafe/docker-socket-policy

Todos los issues de ChainSafe/docker-socket-policy

Issues similares

Más issues de Rust

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.