exec / any other methods open when POST is set to 1 ... | Tecnativa/docker-socket-proxy

Nobody has claimed this yet.

Hello,

just got started using this container to secure watchtower.
but i see strange behavior when i send requests to the api in the below setup:

version: '2'
services:
  watchtower:
    environment:
      DOCKER_HOST: tcp://socket-proxy:2375
    image: ${MY_CONTAINER_REPO}containrrr/watchtower
    depends_on:
      - socket-proxy
    command: -R updatetest_updatetest_1
    restart: unless-stopped
  socket-proxy:
    image: ${MY_CONTAINER_REPO}tecnativa/docker-socket-proxy:edge
    environment:
      POST: 1
      CONTAINERS: 1
      IMAGES: 1
      NETWORKS: 1
      ALLOW_START: 1
      ALLOW_STOP: 1
      ALLOW_RESTARTS: 1
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro

this lets watchtower do its job nicely and the socket-proxy logs show clearly what requests have been done.

however, there is more:
expected behavior:

post requests on containers, images etc. are allowed (and matches watchtowers need)
requests to volumes / exec or any other endpoint is not allowed.
DELETE method is not possible (you do not define it as being allowed in haproxy?)

actual behavior:

a get request to volumes is not allowed(good):

curl http://socket-proxy:2375/volumes
<html><body><h1>403 Forbidden</h1>
Request forbidden by administrative rules.
</body></html>

a post request to exec is allowed!(bad):

curl --json '{"AttachStdin": false, "AttachStdout": true, "AttachStderr": true, "DetachKeys": "ctrl-p,ctrl-q", "Tty": false, "Cmd": ["hostname"]}' http://socket-proxy:2375/containers/913d03458185f403a03133c3ac4fd537e05e8386cc200e0a37
354bfebf69a3d2/exec
{"Id":"9e72a0b2294259fa05309aeb26af6355f38310212a0e32f7493f1e94f9730e5c"}

a delete request is allowed (strange):
below log from watchtower update action:

socket-proxy_1  | ::ffff:192.168.112.3:52366 [25/Jan/2024:16:39:39.507] dockerfrontend dockerbackend/dockersocket 0/0/0/14/14 204 165 - - ---- 1/1/0/0/0 0/0 "DELETE /v1.25/containers/7ec9c82ebaba98045db83ab80ca618c78d0c5e4f03a09f1ab02a7319abb5b0d6?force=1 HTTP/1.1"

environment:

tecnativa/docker-socket-proxy:edge
docker 20.10 on debian bookworm
let me know if you need more info..

Start by examining the HAProxy request rules and Docker API endpoint handling described in the issue, especially POST access to exec and DELETE handling. Reproduce the shown curl requests and watchtower update request, then verify that only the configured operations are accepted and restricted endpoints or methods return 403.

Written by the indexing model from the issue text.

exec / any other methods open when POST is set to 1 and how is DELETE handled ?

Description

Contributor guide

First steps

Research direction

Assessment