AxisCommunications / AxisCommunications/docker-compose-acap
"--disable-host-loopback" should be optional via an exposed AXParameter to enable remote connection from other acap applications
- Dominant language
- C
- Stars
- 2
- Forks
- 2
- Avg merge
- 18m
- Merged PRs (30d)
- 3
Description
### Describe the feature
I am advocating to add an AXParameter to enable access to the host loopback through toggling the presence of '--disable-host-loopback' in the rootless startup call [here](https://github.com/AxisCommunications/docker-compose-acap/blob/c286c63dcde4390646e5ab4d60e6a7f3c347d579/app/dockerdwrapperwithcompose.c#L528)
My use case is consuming the cameras RTSP stream through a rootless dockerised application which may not be aware/detect underlying changes in the interface/IP configuration and should only need to know the relative path to the stream via 'host.docker.internal'.
I realise that RTSP also runs on a privileged port (554) but this can easily be remedied by enabling a custom port above 1024. If there are other services which cannot be moved to custom ports there might be consideration to allow for [this](https://docs.docker.com/engine/security/rootless/#exposing-privileged-ports) but I do not feel that this issue scopes towards the implications of extendng to privileged ports.
### Added value
There are a number of ACAP applications which will consume/forward data from the host for the purposes of recording/backup, telemetry and brokering communication via MQTT which is. natively configured and exposed on the host. Adding a method to explicitly allow loopback access to applications lets users make in an informed decision about whether they would like to implement a less secure (but not root privileged) feature in order to realise many of these applications.
There are many options/ways in which the problem can be solved outlined [here](https://medium.com/@gladevise/accessing-the-hosts-localhost-from-inside-a-docker-container-c5935e275953) but other solutions would require intermediary containers and combining sandboxes/functionality which feels brittle and difficult to implement for most initial users.
Im Happy to collaborate on the PR if the feature is welcome
Contributor guide
Research direction
Start in app/dockerdwrapperwithcompose.c around line 528, where the rootless startup call adds '--disable-host-loopback', and review how AXParameters are exposed in this application. Done means an AXParameter can control whether that option is present, allowing the documented host.docker.internal use case while keeping the security and privileged-port scope described in the issue.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, docker, docker-compose
- Domain
- infrastructure, networking
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100