Skip to main content [How-to] Securing access to your `docker.sock` file. : r/unRAID
r/unRAID icon
Go to unRAID
•

[How-to] Securing access to your `docker.sock` file.

Guide

So we all know you can allow docker containers to query/control aspects of other docker containers via passing /var/run/docker.sock to the container (like with Telegraf). This can be useful for most cases. I have it setup so that the docker socket proxy in on its own docker network for a bit more security.

But what if someone compromised one of your docker containers that has access to the docker socket?

Many of you might already be familiar with Tecnativa's docker-socket-proxy which says:

Giving access to your Docker socket could mean giving root access to your host, or even to your whole swarm, but some services require hooking into that socket to react to events, etc. Using this proxy lets you block anything you consider those services should not do.

Now the setup can be a little difficult for people not well versed in how docker containers work behind the scene so I will help you step-by-step.

Step 1:

Go to the Docker Settings (Advanced View) and enable Preserve user defined networks]

Screenshot

Description: This will prevent unRAID from removing any custom docker networks we create.

Step 2:

SSH into/open the terminal and run docker network create socket_proxy (socket_proxycan be whatever you want to be called so change it when needed)

Description: This creates the docker network that the socket proxy will be in (and other containers can be added to to allow access)

Step 3:

Search dockersocket in CA and hit install. In the container setup, change the network_type to the network you just created. Once done, hit Apply and check the logs.

Screenshot (yours won't have the INFO environment variable)

Step 4:

Once you have it setup, you can go to each container that access's the docker socket and reconfigure it. To add a container to the socket_proxy network, we can add && docker network connect socket_proxy <container name> to the Post Arguments field for a container in the Advanced View.

Examples:

Telegraf:

  • Add environment variable INFO with a value of 1 to your dockersocket container

  • Post Arguments: && docker network connect socket_proxy telegraf

  • Remove the default /var/run/docker.sock mapping

  • Edit your telegraf.conf file to add endpoint = "tcp://dockersocket:2375" under [[inputs.docker]]

hddtemp:

  • Post Arguments: && docker network connect socket_proxy hddtemp

  • Remove the default /var/run/docker.sock mapping

  • Add environment variable DOCKER_HOST with a value of tcp://dockersocket:2375

The everything app, for work. Get everyone working in a single platform designed to manage any type of work.
Learn More
clickup.com
Thumbnail image: The everything app, for work. Get everyone working in a single platform designed to manage any type of work.
Sort by:
Best
Open comment sort options
•

u/spaceinvaderone - feel free to make a video on this if you want

•

I know this is an old thread but are the post arguments added to the dockersocket container or the container I want to give access to?

•

Thanks! Very nice write up, also thanks for adding some examples!

•

Its useful for non-unraid docker hosts, took a bit if figuring out how to do it in unraid. I think I remember hearing that Lime Tech might be working on an official way of attaching multiple networks to a container.

More replies
•

How can I manage modifications made by one container?

For example, Nextcloud-all-in-one made changes unknown on my system and I would like to discover them.

• • Edited

socket-proxy keeps a log of everything that is ran through it and what they call.

For nextcloud AIO, add the container to the socket proxy network you created and set DOCKER_SOCKET_PATH to tcp://<proxy_container_name>:2375

More replies