Module policy 

What a job may ask of the Docker engine through its proxy.

Access to a Docker engine is access to root: a container can mount any host directory, join the host’s network or process namespaces, or run privileged. Every native Linux job reaches the engine through its own proxy, so the proxy is where those requests are seen. In Mode::Audit each one is recorded and still forwarded; in Mode::Enforce it is refused with the rule it broke.

A mount of a path the operator protected (host protect-path) is refused in every mode, off included: the operator asked for that path to be out of every job’s reach, and the engine runs outside the service’s sandbox.

The rules are about the host and about other jobs, never about what a job does inside its own containers:

• a container may bind-mount only the job’s own attempt directory, its dependency caches, and paths the operator allowed, each judged after the host resolves its links;
• no privileged container or exec, no added capability or device, no weakened security profile, and no host network, process, IPC, UTS, user or cgroup namespace;
• no volume bound to a host path and no network attached to the host’s LAN;
• no request about a container another job, or the host, started;
• no host-wide prune, swarm, plugin or secret API.

Structs

Config

The operator’s settings.

Context

What one attempt’s proxy enforces, fixed when the attempt launches.

Record

One recorded violation.

Violation

A rule a request broke.

Enums

Access

Whether a container may bind-mount a host path.

Mode

What the proxy does with a request that breaks a rule.

Target

What a request acts on, when it is one container or exec instance.

Constants

CONFIG_FILE

The policy’s settings, in the configuration directory.

JOB_LABEL

The label the proxy puts on every container a job creates, naming the job’s attempt, so a later request can tell the job’s containers from others.

LOG_DIR

Where violations are recorded, under the state directory.

LOG_FILE

The violation log in LOG_DIR, one JSON object per line.

Functions

check_container_create

Rules a container-create body breaks. allowed says whether a host path may be bind-mounted.

check_endpoint

Rules an unversioned endpoint breaks by what it is, whatever its body.

check_exec_create

Rules an exec-create body breaks.

check_network_create

Rules a network-create body breaks.

check_volume_create

Rules a volume-create body breaks.

read_records

Every record in the log at path and its rotated predecessor, oldest first. A line that does not parse is skipped.

record

Appends records to the log at path, moving a full log aside first.

redirect_engine_socket

Points every bind of the engine’s own socket in a container-create body at proxy, the job’s proxy socket, and returns how many it changed.

referenced_containers

The other containers a container-create body joins or borrows from: container:<id> namespaces and VolumesFrom. Whether each is the job’s own is for the proxy to ask the engine.

resolve

path with its longest existing prefix resolved through links.

target

The container or exec instance an unversioned endpoint names.

unversioned

The API path without its version prefix: /v1.47/containers/x/json becomes /containers/x/json.