Document CetusGuard as a Docker socket proxy solution (#14806)
* Document CetusGuard as a Docker socket proxy solution * Re-add Docker Socket Proxy to docs
Héctor Molinero Fernández committed
Apr 18, 2023 at 17:39 UTC
2e168e9a74eceeb058ce77d9512cee37579a7c3f
2 files changed
+37
-9
collectors/cgroups.plugin/README.md
+3
-2
@@ -120,8 +120,9 @@ container names. To do this, ensure `podman system service` is running and Netda
120
to `/run/podman/podman.sock` (the default permissions as specified by upstream are `0600`, with owner `root`, so you
121
will have to adjust the configuration).
122
123
-[docker-socket-proxy](https://github.com/Tecnativa/docker-socket-proxy) can also be used to give Netdata restricted
124
-access to the socket. Note that `PODMAN_HOST` in Netdata's environment should be set to the proxy's URL in this case.
123
+[Docker Socket Proxy (HAProxy)](https://github.com/Tecnativa/docker-socket-proxy) or [CetusGuard](https://github.com/hectorm/cetusguard)
124
+can also be used to give Netdata restricted access to the socket. Note that `PODMAN_HOST` in Netdata's environment should
125
+be set to the proxy's URL in this case.
126
127
### Charts with zero metrics
128
packaging/docker/README.md
+34
-7
@@ -331,17 +331,17 @@ your machine from within the container. Please read the following carefully.
331
#### Docker socket proxy (safest option)
332
333
Deploy a Docker socket proxy that accepts and filters out requests using something like
334
-[HAProxy](https://github.com/netdata/netdata/blob/master/docs/Running-behind-haproxy.md) so that it restricts connections to read-only access to the CONTAINERS
334
+[HAProxy](https://github.com/netdata/netdata/blob/master/docs/Running-behind-haproxy.md) or
335
+[CetusGuard](https://github.com/hectorm/cetusguard) so that it restricts connections to read-only access to the `/containers`
336
endpoint.
337
338
The reason it's safer to expose the socket to the proxy is because Netdata has a TCP port exposed outside the Docker
339
network. Access to the proxy container is limited to only within the network.
340
340
-Below is [an example repository (and image)](https://github.com/Tecnativa/docker-socket-proxy) that provides a proxy to
341
-the socket.
341
+Here are two examples, the first using [a Docker image based on HAProxy](https://github.com/Tecnativa/docker-socket-proxy)
342
+and the second using [CetusGuard](https://github.com/hectorm/cetusguard).
343
343
-You run the Docker Socket Proxy in its own Docker Compose file and leave it on a private network that you can add to
344
-other services that require access.
344
+##### Docker Socket Proxy (HAProxy)
345
346
```yaml
347
version: '3'
@@ -356,13 +356,40 @@ services:
356
proxy:
357
image: tecnativa/docker-socket-proxy
358
volumes:
359
- - /var/run/docker.sock:/var/run/docker.sock:ro
359
+ - /var/run/docker.sock:/var/run/docker.sock:ro
360
environment:
361
- CONTAINERS=1
362
-
362
```
363
**Note:** Replace `2375` with the port of your proxy.
364
365
+##### CetusGuard
366
+
367
+```yaml
368
+version: '3'
369
+services:
370
+ netdata:
371
+ image: netdata/netdata
372
+ # ... rest of your config ...
373
+ ports:
374
+ - 19999:19999
375
+ environment:
376
+ - DOCKER_HOST=cetusguard:2375
377
+ cetusguard:
378
+ image: hectorm/cetusguard:v1
379
+ read_only: true
380
+ volumes:
381
+ - /var/run/docker.sock:/var/run/docker.sock:ro
382
+ environment:
383
+ CETUSGUARD_BACKEND_ADDR: unix:///var/run/docker.sock
384
+ CETUSGUARD_FRONTEND_ADDR: tcp://:2375
385
+ CETUSGUARD_RULES: |
386
+ ! Inspect a container
387
+ GET %API_PREFIX_CONTAINERS%/%CONTAINER_ID_OR_NAME%/json
388
+```
389
+
390
+You can run the socket proxy in its own Docker Compose file and leave it on a private network that you can add to
391
+other services that require access.
392
+
393
#### Giving group access to the Docker socket (less safe)
394
395
> :warning: Caution