Mapping docker Unix socket to HA container

[dense locust]

Just looking for a quick sanity check: Is it much of a security risk to map /var/run/docker.sock as a volume so that I can issue docker API commands via HA? I just set this up and now thinking back about whether it was a good idea

[jade moss]

Through the docker socket you basically expose root permissions, so yes, this is a security risk. Especially considering that HA still doesn't have a permission system. You can use a docker socket proxy to limit the commands that can be issued through the socket.

https://github.com/wollomatic/socket-proxy

[dense locust]

Thanks, this looks like a great way to limit the risk. I will try this out

[dense locust]

this worked out great, thanks for the suggestion!

[jade moss]

If you want to increase security a bit further, have a look at https://github.com/FoxxMD/docker-proxy-filter

If you stack that on top of socket-proxy (it is designed to be used WITH socket-proxy, not alone), you can also define which containers to expose and if you want to expose ENV vars (which of course often holds secrets and are not required for all tools that need/want to have access to the Docker socket).