Objective
Understand the options to secure the docker.sock.
Background
As in those articles, giving containers the access to docker.sock is a risk.
- Don't expose the Docker socket (not even to a container)
- Access Docker socket within container
- The Dangers of Docker.sock
However there could be cases where we need to deploy a pod such which needs to talk to docker daemon via the socket for monitoring or controlling. For example datadog which mounts the socket via hostPath mount.
Options
OpenShift requires explicit grant of SCC e.g. hostaccess to the service account which runs the pod for the pod to use hostPath, but it is OpenShift proprietary.
I suppose SELinux can be used so that any pods who access the docker socker are required to have a certain label.
Question
I would like to know if my understanding of SELinux label is valid, and what other options would be available.