Allow POST /containers/{name}/update limited to resource fields
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 15/100
- Issue 类型
- 功能
- 描述清晰度
- 基本清楚
- 活跃度
- 活跃
- 技术栈
- docker, go, rust, typescript
调研方向
Start from the create-path allowlist added in #88, which defines the resource fields this change should reuse, then find where the router decides on POST /containers/{name}/update in each of the three implementations. The issue says the change is deferred on purpose, so confirm with maintainers before writing code. Done means the update endpoint is allowed only for resource fields and a matching RestartPolicy, every other key or case variant is denied, and the spec and tests cover both cases in all three implementations.
由索引模型根据 Issue 内容生成。
描述
Is your feature request related to a problem?
The router denies POST /containers/{name}/update for every container. community.docker.docker_container uses that endpoint to change an existing container in place, without recreating it, when only these differ:
- resource limits (
Memory,MemoryReservation,MemorySwap,CpuShares,CpuPeriod,CpuQuota,CpusetCpus,CpusetMems,BlkioWeight, …) RestartPolicy
So when a role changes a limit on a running container behind the proxy, the task fails with 403 instead of applying the change. The same happens when the role's restart_policy differs from the value the policy forces. Creating a container with limits works; since #88 the create path allows these fields.
On an existing container, a role that sets networks: also calls POST /networks/{id}/connect and /disconnect, which the proxy denies as well.
Adding the deploy user to the docker group would work around it, but that bypasses the proxy completely.
Describe the solution
Allow POST /containers/{name}/update for a container under a policy. The body may set only the resource fields that #88 already allows on create. It may set RestartPolicy only when it equals the policy's forced restart_policy, or freely when the policy forces none. Everything else is denied: other keys, case variants of field names, non-zero values outside that set. Add it to the router, the spec and the tests in all three implementations.
Describe alternatives
- Recreate instead of update: in the role, set
recreate: truewhen a limit changes. This needs no proxy change and works today. - Keep the deny and document the limitation (the status quo).
Which implementation(s) would this affect?
- Go
- Rust
- TypeScript
- Quint specification
- All
Additional context
This is deferred on purpose. We will pick it up when a deploy needs in-place updates or a user asks for it. Until then, roles should recreate the container on limit changes. Found while reviewing the lodestar-infrastructure PR 9 deploy spec against #88.
- 主要语言
- Rust
- 星标
- 2
- 派生
- 0
- 平均合并
- 12 小时 11 分钟
- 30 天内合并 PR
- 30
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
ChainSafe/docker-socket-policy 的其他 Issue
-
Type: Feature
难度 5/5 一周以上 新手友好度 12/100
ChainSafe/docker-socket-policy#96 ·
维护者通常 1 天内回复
-
Type: Feature
难度 5/5 一周以上 新手友好度 25/100
ChainSafe/docker-socket-policy#65 ·
维护者通常 1 天内回复
-
Type: Enhancement
难度 5/5 一周以上 新手友好度 38/100
ChainSafe/docker-socket-policy#46 · 1 条评论 ·
维护者通常 1 天内回复
查看 ChainSafe/docker-socket-policy 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 65/100
-
难度 2/5 1-3 小时 新手友好度 70/100
-
area: compat area: parsing bug
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复
-
Volume eject does not refuse system, root or /home mounts可能已有人在做 @bernardopg 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 72/100
spacedriveapp/spacedrive#3159 ·
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 82/100