My intention is to create/show/delete images and containers automatically with Docker.
According to Docker's security guidelines exposing Docker's daemon to a port is a high security risk, because anybody could connect and use it:
You could set it to 0.0.0.0:2375 or a specific host IP to give access to everybody, but that is not recommended because then it is trivial for someone to gain root access to the host where the daemon is running. source 1
Other possibility is to run a container on 'privileged' mode that will be on charge of creating containers INSIDE a docker container (docker-russian-doll). But has some problems as described here.
I was thinking about a 3rd option:
Create a minimal image that will mount the socket internally, for example with docker-compose:
volumes: - /var/run/docker.sock:/var/run/docker.sock
Write a small client (with Java for example) that connects to the socket and exposes it with a
--yet-another-although-minimal
REST APILet that container to run as a root user
- Link any container that wants to create images/containers using docker-links, for example with docker-compose.
Assumptions:
- The approach is for pet projects, I don't want to setup a private network or similar
- The idea is to create images/containers with a minimalistic approach
- No critical data will be stored nor critical applications will be running on these host
I based on the premise that that links between containers are "secure" communication.
Questions:
Is this root-container with minimal REST API layer more secure than exposing the socket as IP:PORT?
Will this approach reduce the possibilities of an attacker trying to get control over the socket?