docker: fix socket permissions
Docker socket is world writable. This means any user on the system is able to invoke docker command. (Which is equal to having a root access to the machine.) This commit makes socket group-writable and owned by docker group. Inspired by https://github.com/docker/docker/blob/master/contrib/init/systemd/docker.socket
This commit is contained in:
parent
a29d0df28c
commit
fa4fe71105
|
@ -126,7 +126,17 @@ in
|
|||
|
||||
path = [ pkgs.kmod ] ++ (optional (cfg.storageDriver == "zfs") pkgs.zfs);
|
||||
};
|
||||
systemd.sockets.docker.socketConfig.ListenStream = cfg.listenOptions;
|
||||
|
||||
systemd.sockets.docker = {
|
||||
description = "Docker Socket for the API";
|
||||
wantedBy = [ "sockets.target" ];
|
||||
socketConfig = {
|
||||
ListenStream = cfg.listenOptions;
|
||||
SocketMode = "0660";
|
||||
SocketUser = "root";
|
||||
SocketGroup = "docker";
|
||||
};
|
||||
};
|
||||
}
|
||||
]);
|
||||
|
||||
|
|
Loading…
Reference in a new issue