Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Have dind use host's /etc/docker to ensure networks use safe subnets #23

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

chewi
Copy link

@chewi chewi commented Aug 6, 2019

You may have configured Docker to avoid subnets used by your internal
infrastructure but we need to ensure that networks created by docker-compose
inside dind also respect this.

You may have configured Docker to avoid subnets used by your internal
infrastructure but we need to ensure that networks created by docker-compose
inside dind also respect this.

Signed-off-by: James Le Cuirot <[email protected]>
@rlupton20
Copy link
Collaborator

Can you explain exactly what configuration you need? Do you need to mount all of /etc/docker or just a single file? Is this portable over different docker installations?

@chewi
Copy link
Author

chewi commented Aug 6, 2019

Admittedly this was just for daemon.json and I don't know what else goes in /etc/docker. This just reduced the risk of it creating a directory called daemon.json. I suppose it could be smarter and only add the argument if daemon.json actually exists.

I'm not sure what you mean about it being portable. Do you have any specific concerns?

@rlupton20
Copy link
Collaborator

I think docker is smart enough to mount files as files, so probably no need to worry about that.

Portable might be the wrong word - I was worried that different distros would place this file in different places. I have /etc/docker on nixos however, and if nixos has it that probably means everything does.

The other question I have is does this have any possible impact on reproducibility of environments? Properties of the host now can potentially impact the floki container - how explicit would we want to make this? Would docker-on-docker supersede this?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants