Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Explicitly make docker socket rw in documentation #348

Merged
merged 1 commit into from
Aug 3, 2021

Conversation

Syphdias
Copy link
Contributor

Docker does not allow for read-only mounts of sockets at this point.
This can be tested by running:

❯ docker run --rm -it -v /var/run/docker.sock:/tmp/docker.sock:ro \
    docker ls -l /tmp/docker.sock
srw-rw----    1 root     967              0 Apr 13 16:16 /tmp/docker.sock
❯ docker run --rm -it -v /var/run/docker.sock:/tmp/docker.sock:ro \
    docker /usr/local/bin/docker -H unix:///tmp/docker.sock ps |wc -l
17

Even if docker supported read-only sockets, you would not want it to be
read-only if you are using -notify-sighup because then the docker socket is
used to communicate to the other container to notify it.

This change in documentation reflects the fact that the socket will be writable.

Docker does not allow for read-only mounts of sockets at this point.
This can be tested by running:
❯ docker run --rm -it -v /var/run/docker.sock:/tmp/docker.sock:ro \
    docker ls -l /tmp/docker.sock
srw-rw----    1 root     967              0 Apr 13 16:16 /tmp/docker.sock
❯ docker run --rm -it -v /var/run/docker.sock:/tmp/docker.sock:ro \
    docker /usr/local/bin/docker -H unix:///tmp/docker.sock ps |wc -l
17

Even if docker supported read-only sockets, you would not want it to be
read-only if you are using `-notify-sighup` because then the docker socket is
used to communicate to the other container to notify it.

This change in documentation reflects the fact that the socket will be writable.
@buchdag
Copy link
Member

buchdag commented Jun 15, 2021

While :ro does not prevent writes to the socket, I think it does prevent the socket's deletion by the container.

@Syphdias
Copy link
Contributor Author

I don't think that's possible with :rw either:

❯ docker run --rm -it -v /var/run/docker.sock:/tmp/docker.sock:rw docker rm /tmp/docker.sock
error during connect: Delete http://docker:2375/v1.24/containers/tmp/docker.sock: dial tcp: lookup docker on 10.2.23.83:53: server misbehaving
❯ docker run --rm -it -v /var/run/docker.sock:/tmp/docker.sock:rw docker sh
/ # rm /tmp/docker.sock
rm: can't remove '/tmp/docker.sock': Resource busy
/ # 

@buchdag buchdag merged commit f46d486 into nginx-proxy:main Aug 3, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants