exec / any other methods open when POST is set to 1 and how is DELETE handled ? #114
Description
Hello,
just got started using this container to secure watchtower.
but i see strange behavior when i send requests to the api in the below setup:
version: '2'
services:
watchtower:
environment:
DOCKER_HOST: tcp://socket-proxy:2375
image: ${MY_CONTAINER_REPO}containrrr/watchtower
depends_on:
- socket-proxy
command: -R updatetest_updatetest_1
restart: unless-stopped
socket-proxy:
image: ${MY_CONTAINER_REPO}tecnativa/docker-socket-proxy:edge
environment:
POST: 1
CONTAINERS: 1
IMAGES: 1
NETWORKS: 1
ALLOW_START: 1
ALLOW_STOP: 1
ALLOW_RESTARTS: 1
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
this lets watchtower do its job nicely and the socket-proxy logs show clearly what requests have been done.
however, there is more:
expected behavior:
- post requests on containers, images etc. are allowed (and matches watchtowers need)
- requests to volumes / exec or any other endpoint is not allowed.
- DELETE method is not possible (you do not define it as being allowed in haproxy?)
actual behavior:
- a get request to volumes is not allowed(good):
curl http://socket-proxy:2375/volumes
<html><body><h1>403 Forbidden</h1>
Request forbidden by administrative rules.
</body></html>
- a post request to exec is allowed!(bad):
curl --json '{"AttachStdin": false, "AttachStdout": true, "AttachStderr": true, "DetachKeys": "ctrl-p,ctrl-q", "Tty": false, "Cmd": ["hostname"]}' http://socket-proxy:2375/containers/913d03458185f403a03133c3ac4fd537e05e8386cc200e0a37
354bfebf69a3d2/exec
{"Id":"9e72a0b2294259fa05309aeb26af6355f38310212a0e32f7493f1e94f9730e5c"}
- a delete request is allowed (strange):
below log from watchtower update action:
socket-proxy_1 | ::ffff:192.168.112.3:52366 [25/Jan/2024:16:39:39.507] dockerfrontend dockerbackend/dockersocket 0/0/0/14/14 204 165 - - ---- 1/1/0/0/0 0/0 "DELETE /v1.25/containers/7ec9c82ebaba98045db83ab80ca618c78d0c5e4f03a09f1ab02a7319abb5b0d6?force=1 HTTP/1.1"
environment:
- tecnativa/docker-socket-proxy:edge
- docker 20.10 on debian bookworm
- let me know if you need more info..