lablup / lablup/backend.ai

Metadata URL support for security and rich features

Open
#309 1 comment 0 reactions 1 assignee Claimed by @kyujin-cho View on GitHub
Dominant language
Python
Stars
670
Forks
183
Avg merge
17h 7m
Merged PRs (30d)
358

Description

Metadata URLs in clouds (e.g., 169.254.169.254 in AWS EC2) exposes many system detail information to containers.We need to restrict some of those information and also need to provide a more flexible way of interacting with the agent and containers and user programs.

Using the following command in the agent host, access to `http://169.254.169.254` is redirected to `172.17.0.1:8000`, where 172.17.0.1 is the IP address of the `docker0` interface, while still allowing the host's metadata access:

```shell
$ iptables -t nat \
-I PREROUTING \
-p tcp \
-d 169.254.169.254 \
--dport 80 \
-j REDIRECT \
--to-ports 8000 \
-i docker0
```

Let's make the agent to listen on a specific local port on the docker0 interface and redirect the metadata URL traffic to it.After then, we could expand features based on container-agent interactions.We need to detect `docker0` IP address at runtime or at least it should be configurable, because it may be different site-by-site.

JIRA Issue: BA-285

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.