mirror of
https://github.com/kemko/nomad.git
synced 2026-01-01 16:05:42 +03:00
0ece7b5c16
This enables checks for ContainerAdmin user on docker images on Windows. It's only checked if users run docker with process isolation and not hyper-v, because hyper-v provides its own, proper sandboxing. --------- Co-authored-by: Tim Gross <tgross@hashicorp.com>
38 lines
1.2 KiB
Go
38 lines
1.2 KiB
Go
// Copyright (c) HashiCorp, Inc.
|
|
// SPDX-License-Identifier: BUSL-1.1
|
|
|
|
//go:build windows
|
|
|
|
package docker
|
|
|
|
import (
|
|
"errors"
|
|
|
|
docker "github.com/fsouza/go-dockerclient"
|
|
)
|
|
|
|
// Currently Windows containers don't support host ip in port binding.
|
|
func getPortBinding(ip string, port string) docker.PortBinding {
|
|
return docker.PortBinding{HostIP: "", HostPort: port}
|
|
}
|
|
|
|
func tweakCapabilities(basics, adds, drops []string) ([]string, error) {
|
|
return nil, nil
|
|
}
|
|
|
|
var containerAdminErrMsg = "running container as ContainerAdmin is unsafe; change the container user, set task configuration to privileged or enable windows_allow_insecure_container_admin to disable this check"
|
|
|
|
func validateImageUser(user, taskUser string, taskDriverConfig *TaskConfig, driverConfig *DriverConfig) error {
|
|
// we're only interested in the case where isolation is set to "process"
|
|
// (it's also the default) and when windows_allow_insecure_container_admin
|
|
// is explicitly set to true in the config
|
|
if driverConfig.WindowsAllowInsecureContainerAdmin || taskDriverConfig.Isolation == "hyper-v" {
|
|
return nil
|
|
}
|
|
|
|
if user == "ContainerAdmin" && (taskUser == "ContainerAdmin" || taskUser == "") && !taskDriverConfig.Privileged {
|
|
return errors.New(containerAdminErrMsg)
|
|
}
|
|
return nil
|
|
}
|