Runner mounts socket which is $bad #4

New Issue

decentral1se · 2021-03-16T08:44:14Z

decentral1se commented

2021-03-16 08:44:14 +00:00

As we now know from https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers, it is a considerable attack vector to expose the docker socket to other containers. We do this for the runner in e54a564923/compose.yml (L8) because this runner spawns its own containers. That actually can't be avoided I would say. Maybe we need to consider moving the runner to its own machine which is locked down away from other apps.

/cc @kawaiipunk

As we now know from https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers, it is a considerable attack vector to expose the docker socket to other containers. We do this for the runner in https://git.autonomic.zone/coop-cloud/drone-docker-runner/src/commit/e54a5649237c3dfcd0ba16b580739578fc0a757e/compose.yml#L8 because this runner spawns its own containers. That actually can't be avoided I would say. Maybe we need to consider moving the runner to its own machine which is locked down away from other apps. /cc @kawaiipunk

Sign in to join this conversation.

No Label

No Milestone

No Assignees

1 Participants

Notifications

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: coop-cloud/drone-docker-runner#4