Risks of using a root container to manage Docker daemon

Question

My intention is to create/show/delete images and containers automatically with Docker.

According to Docker's security guidelines exposing Docker's daemon to a port is a high security risk, because anybody could connect and use it:

You could set it to 0.0.0.0:2375 or a specific host IP to give access to everybody, but that is not recommended because then it is trivial for someone to gain root access to the host where the daemon is running. ^{source 1}

Other possibility is to run a container on 'privileged' mode that will be on charge of creating containers INSIDE a docker container (docker-russian-doll). But has some problems as described here.

I was thinking about a 3rd option:

1. Create a minimal image that will mount the socket internally, for example with docker-compose:

   volumes:
     - /var/run/docker.sock:/var/run/docker.sock
   

2. Write a small client (with Java for example) that connects to the socket and exposes it with a--yet-another-although-minimal REST API

3. Let that container to run as a root user

4. Link any container that wants to create images/containers using docker-links, for example with docker-compose.

Assumptions:

• The approach is for pet projects, I don't want to setup a private network or similar
• The idea is to create images/containers with a minimalistic approach
• No critical data will be stored nor critical applications will be running on these host

I based on the premise that that links between containers are "secure" communication.

Questions:

1. Is this root-container with minimal REST API layer more secure than exposing the socket as IP:PORT?

2. Will this approach reduce the possibilities of an attacker trying to get control over the socket?

Answer 1

Will this approach reduce the possibilities of an attacker trying to get control over the socket?

Maybe, but probably not much. Why bother? Opening port 2375 for everyone is not the way Docker is meant to be configured and documentation rightfully warns against it.

Follow the Protect the Docker daemon socket guide and set up the TLS port with the TLS client verification.

Or use the Docker Machine which, given the SSH credentials to the machine running the Docker Engine, will automatically set these things up.