Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Feature: per-socket (per-instance) exec allowlist

Aperta
  • Qualcosa non va?
#65 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
25/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
go, rust, typescript
Ambito
backend, security

Direzione di ricerca

Read the README's “Trust model,” issue #39, and the exec deny rules in #49; inspect the Go, Rust, and TypeScript implementations and spec/docker_socket_policy.qnt. The proposal leaves key policy decisions open, including command matching, container scope, exec-ID tracking, and fields to restrict, so this is design work rather than a bounded first contribution.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Type: Feature

Is your feature request related to a problem?

Exec is hard-coded as denied in all three implementations: POST /containers/<name>/exec and POST /exec/<id>/start. No policy or configuration can enable it. Some deployments may legitimately want callers of one socket to run a limited set of commands in their containers, for example a health or debug command, while other sockets stay locked down.

Today's model:

  • The trust boundary is the listening socket (see README "Trust model" and #39). Anyone who can connect gets everything that proxy instance allows. The proxy has no caller identity.
  • Policies are per service and are selected by image name only on POST /containers/create. Exec requests carry no image, so a policy cannot be selected for them.

So "per socket" means per proxy instance.

Describe the solution (for future consideration; not designed yet)

An instance-level setting, as a flag or a config file next to the policies, that allows exec under explicit limits. Open questions:

  • Command allowlist, matched on Cmd in the exec-create body, using the same flag/value-pattern machinery as CmdGate. Is a plain on/off switch ever acceptable?
  • Container scope: restrict to containers created from images matching a policy's allowed_image_prefixes, or to named containers. This needs the daemon's container-to-image mapping at exec time.
  • Fields to force or deny: Privileged: true (always deny?), User (force it?), Env, Tty/AttachStdin.
  • POST /exec/<id>/start, /resize, and GET /exec/<id>/json: start can only be allowed for exec instances this proxy created and approved, which means tracking exec IDs. Inspect leaks other users' exec command lines (verified in #49: ExecIDs from container inspect, then GET /exec/<id>/json, shows the full arguments including inline secrets).
  • Spec: a new invariant in spec/docker_socket_policy.qnt, replacing "execContainer unconditionally returns false", such as "every executed command matches the instance allowlist".
  • Audit: log every exec create and start, with the command.

Describe alternatives

  • Keep exec denied everywhere (status quo). Simplest and safest. Users who need exec use the daemon socket directly, outside the proxy's guarantees.
  • Per-policy setting. Not workable: exec requests carry no image, so there is no policy to select (see above).
  • Per-caller identity. Rejected by the #39 trust model.

Which implementation(s) would this affect?

  • All (Go, Rust, TypeScript, Quint specification)

Additional context

Raised while converging the exec deny rules in #49. #49 keeps exec denied and only fixes the cross-language differences.

Lingua principale
Rust
Stelle
2
Fork
0
Merge medio
14h 26m
PR unite (30g)
27

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di ChainSafe/docker-socket-policy

Tutte le issue di ChainSafe/docker-socket-policy

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.