Option to secure docker socket from containers

Question

Objective

Understand the options to secure the docker.sock.

Background

As in those articles, giving containers the access to docker.sock is a risk.

• Don't expose the Docker socket (not even to a container)
• Access Docker socket within container
• The Dangers of Docker.sock

However there could be cases where we need to deploy a pod such which needs to talk to docker daemon via the socket for monitoring or controlling. For example datadog which mounts the socket via hostPath mount.

Options

OpenShift requires explicit grant of SCC e.g. hostaccess to the service account which runs the pod for the pod to use hostPath, but it is OpenShift proprietary.

I suppose SELinux can be used so that any pods who access the docker socker are required to have a certain label.

Question

I would like to know if my understanding of SELinux label is valid, and what other options would be available.

References

• Hardening Docker containers and hosts against vulnerabilities: a security toolkit

Answer 1

It sounds like you're asking about Kubernetes. PodSecurityPolicy is the Kubernetes upstreamed version of OpenShift's Security Context Constraints (SCC), and can be used to limit access to HostPath volumes. However, there is a known issue with the AllowedPaths implementation, so it is safest to disable HostPath volumes completely for Pods that don't require it. Assuming the docker socket requires root privileges to access, you can also restrict which containers are running as root (don't forget to set no_new_privs, disable AllowPrivilegeEscalation in Kubernetes).