Assuming I am running several docker containers on a local server. When I give third parties ssh access to my server, any third party will have control over the docker manager. How can I make sure each remote user has access only to some specific containers?
Add a comment
|
2 Answers
EEAA is correct, there is no built-in way to do this. The best way to do this right now is the same way you'd do this for any other system. For example, you could run an SSH daemon on your docker container, using something like supervisord to launch multiple apps. A docker container is intended to run one app, tools like supervisord get around this by launching multiple processes for you and keeping them started.
At that point, you'd just have to ensure their public key is on every docker container that they should have access to. Remember though, you'll want to have SELinux enabled and preferably the USER directive configured in docker to launch the container as a limited user.
answered Jan 8, 2015 at 18:41
Docker does not have this functionality built in. You'll need to write a custom wrapper script to perform your access control.
Additionally, you probably want to think seriously about whether docker's rather weak isolation is adequate for your purposes from a security perspective. From its inception, Docker has not put emphasis on security, but rather on application portability and ease of deployment. They are working on the security aspect, but there's much more to be done before I'd be comfortable giving any third-party access to a container running on one of my hosts.
