Infrastructure: Docker socket mount grants excessive privileges #6

New issue

Closed

opened 2026-03-10 03:46:05 +00:00 by Mark · 1 comment

Mark commented

2026-03-10 03:46:05 +00:00

Owner

Issue

The API container mounts /var/run/docker.sock with full Docker control, granting container escape capabilities if API is compromised.

Location

docker-compose.yml:43
docs/SECURITY.md documents this as the #1 security risk

Current Implementation

volumes:
  - /var/run/docker.sock:/var/run/docker.sock

Risk

Complete host compromise if API is breached
No privilege separation
Documented as highest security risk

Proposed Solution (from SECURITY.md roadmap)

Replace docker.sock with constrained runner (gRPC/SSH)
Move orchestration to Kubernetes with RBAC
Use rootless Podman with dedicated API socket and strict SELinux/AppArmor

Acceptance Criteria

Research and implement constrained runner approach
Remove docker.sock mount
Implement gRPC/SSH communication with runner
Add least-privilege policies

Priority: High
Type: Infrastructure/Security

## Issue The API container mounts `/var/run/docker.sock` with full Docker control, granting container escape capabilities if API is compromised. ## Location - `docker-compose.yml:43` - `docs/SECURITY.md` documents this as the #1 security risk ## Current Implementation ```yaml volumes: - /var/run/docker.sock:/var/run/docker.sock ``` ## Risk - Complete host compromise if API is breached - No privilege separation - Documented as highest security risk ## Proposed Solution (from SECURITY.md roadmap) 1. Replace docker.sock with constrained runner (gRPC/SSH) 2. Move orchestration to Kubernetes with RBAC 3. Use rootless Podman with dedicated API socket and strict SELinux/AppArmor ## Acceptance Criteria - [ ] Research and implement constrained runner approach - [ ] Remove docker.sock mount - [ ] Implement gRPC/SSH communication with runner - [ ] Add least-privilege policies **Priority:** High **Type:** Infrastructure/Security