knrdl / docker-socket-protector Goto Github PK

I've been testing the beta of Traefik Hub with traefik-docker-protector and observed from the logs:

 % docker logs -f hub-agent
{"level":"info","version":"v1.0.1","module":"github.com/traefik/hub-agent-traefik","commit":"0ddfa03","built":"2022-11-23_03:32:31PM","go_version":"go1.19.3","os":"linux","arch":"amd64","time":1678957310}
{"level":"info","addr":"http://hub-agent","time":1678957311,"message":"Using Agent reachable address"}
{"level":"info","addr":"0.0.0.0:80","time":1678957311,"message":"Starting auth server"}
{"level":"error","error":"get Traefik networks: Error response from daemon: denied request to: /v1.24/networks","time":1678957311}

This would probably be a quick fix in https://github.com/knrdl/traefik-docker-protector/blob/68bd9dc412097044e1ccea88632dcce0bed2c92c/src/main.go#L17 by removing the additional regex lookup for the filter param. It would appear to be safe enough to make this change as the API is filtered to just GET requests.

Should I submit a PR?

The current profiles for portainer don’t work for me.

2023/04/18 18:20:42 Profile rule is invalid: GET (/v\d+\.\d+)?/containers/[0-9a-fA-F]+/(json|top|logs|stats).*$

Hey @knrdl

I stumbled on this project as I was looking for way to better secure my Docker socket and noticed that you support proxying Traefik access to the Docker socket via a small set of the Docker Engine API endpoints. I wonder if you would consider opening this up to conditionally allow other API URI's via config file or environment vars for the container.

This could then allow other applications like Watchtowerr or Portainer to be conditionally granted access to the API endpoints they need, while leaving all other disabled by setting a boolean flag. You could also refer to https://github.com/fluencelabs/docker-socket-proxy/blob/master/haproxy.cfg which has a more exhaustive version of URI filters.

I see this is how the Tecnativa Docker socket proxy also operates but both of these solutions are built on an older version of HAProxy.

I'd love to contribute but sadly know zero Golang to open a PR up for this request sorry.