Docker daemon socket is exposed to containers 이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우
언제든지 연락주시기 바랍니다. Id: kubernetes-docker-daemon-socket-is-exposed-to-containers
Platform: Kubernetes
Severity: Medium
Category: Access Control
Learn More Description The Docker daemon socket should not be exposed to containers. Mounting /var/run/docker.sock into a container grants the container direct access to the host Docker daemon, which can enable privilege escalation and full control of the host. Alternatives include using isolated build environments, container runtime APIs with proper access controls, or dedicated build services.
Compliant Code Examples apiVersion : v1
kind : Pod
metadata :
name : test-pd
spec :
containers :
- image : k8s.gcr.io/test-webserver
name : test-container
volumeMounts :
- mountPath : /test-pd
name : test-volume
volumes :
- name : test-volume
hostPath :
path : /data
type : Directory
Non-Compliant Code Examples apiVersion : v1
kind : Pod
metadata :
name : test-pd
spec :
containers :
- image : k8s.gcr.io/test-webserver
name : test-container
volumeMounts :
- mountPath : /test-pd
name : test-volume
volumes :
- name : test-volume
hostPath :
path : /var/run/docker.sock
type : Directory
---
apiVersion : v1
kind : ReplicationController
metadata :
name : node-manager
labels :
name : node-manager
spec :
selector :
name : node-manager
template :
metadata :
labels :
name : node-manager
spec :
containers :
- image : k8s.gcr.io/test-webserver
name : test-container
volumeMounts :
- mountPath : /test-pd
name : test-volume
volumes :
- name : test-volume
hostPath :
path : /var/run/docker.sock
type : Directory
---
apiVersion : batch/v1beta1
kind : CronJob
metadata :
name : hello
spec :
schedule : "*/1 * * * *"
jobTemplate :
spec :
template :
spec :
containers :
- image : k8s.gcr.io/test-webserver
name : test-container
volumeMounts :
- mountPath : /test-pd
name : test-volume
volumes :
- name : test-volume
hostPath :
path : /var/run/docker.sock
type : Directory
