Docker Read Broker Security

Purpose

The broker contains the unavoidable Docker socket trust boundary and prevents MCP-facing services from receiving raw Engine API access.

v1 API allowlist

list registered containers with bounded fields;
inspect one registered container;
read health/status;
read bounded recent logs;
list registered networks needed for topology display;
return host Docker version and non-sensitive capacity summary.

Explicitly absent

create/start/stop/restart/remove;
exec;
image build/pull/push/remove;
volume content access;
secret/config access;
arbitrary Docker API path;
arbitrary filters that reveal unrelated containers;
host filesystem mounts.

Registration

The Hub passes a signed or mutually authenticated request containing a stable project/environment registration. The broker maps that registration to container IDs or immutable labels discovered during reconciliation. A client-supplied container name is never trusted alone.

Hardening

internal connector network only;
mTLS or short-lived internal service token;
no published host port;
read-only root filesystem and no package manager;
minimal dependencies;
bounded log bytes and time range;
reject containers not registered to the project;
structured Docker SDK calls, never shell commands;
dedicated security tests against write methods.

Mounting the socket read-only does not make Docker access read-only by itself. The broker's application-level API is the controlling boundary.

1.5 KiB Raw Blame History