Presets

# Allows: container read
# Allows: container lifecycle (start, stop, restart, kill, rename, update, wait, create, remove)
# Allows: image read, pull, remove
# Allows: network read + connect, volume read, distribution, Swarm service reads
# Denies: exec, build, swarm writes, secrets, plugins, raw archive/export/logs/attach streams
# container-create bodies are inspected by default — add host bind-mount sources to
# request_body.container_create.allowed_bind_mounts if your updates require them.
# image pulls are inspected too; this preset explicitly allows arbitrary registries
# while still denying image imports via fromSrc
# container updates are inspected; restart-policy/resource/device/capability changes
# stay denied unless you explicitly allow them under request_body.container_update
# container removal permits drydock's force-removal recovery path but keeps
# anonymous-volume and legacy-link deletion denied
# the stock "runc" runtime is allowlisted (request_body.container_create.allowed_runtimes)
# because drydock recreates containers from their inspect spec, which usually carries an
# explicit HostConfig.Runtime — without it every update would 403 at /containers/create
# Three response redactions are off: redact_mount_paths, redact_container_env
# and redact_network_topology. redact_sensitive_data stays on, at its default.
# Drydock recreates a container from its own
# inspect payload, so a "<redacted>" placeholder would be forwarded straight into
# POST /containers/create and dockerd would reject it. The four drydock-with-*
# presets inherit this; re-enable them only if the consumer never replays inspect
# output back into a create body.

# Extends drydock.yaml with:
# Allows: POST /containers/{id}/exec, POST /exec/{id}/start, GET /exec/{id}/json
# Allows: container-create bodies that bind-mount /var/run/docker.sock
#         (request_body.container_create.allowed_bind_mounts, which drydock.yaml
#         leaves empty). The socket-mode recreate needs it; set it back to [] if
#         drydock reaches the daemon over TCP. This is the largest security
#         difference between the two presets.
# Exec body inspection: allow_privileged=false, allow_root_user=true
# (drydock's exec create sets no User field, and sockguard treats an empty
# User as root, so allow_root_user must be true or the finalize exec is
# denied before allowed_commands is ever checked)
# allowed_commands pins exec to the single finalize entrypoint argv, so the
# root-user allowance is safe: only that exact command can run
# allowed_env_vars pins exec Env to the six DD_SELF_UPDATE_* names. Without it
# the argv pin is not enough on its own: NODE_OPTIONS could --require arbitrary
# code under the pinned node command
# allowed_env_values pins the finalize callback to Drydock's loopback URL at
# port 3000; update the exact value if you configure a different server port

# Extends drydock.yaml with:
# Allows: POST /networks/create, DELETE /networks/*, POST /networks/*/disconnect
#         POST /volumes/create, DELETE /volumes/*
# (POST /networks/*/connect is already allowed by drydock.yaml — untouched)
# Body inspection for the new endpoints reuses drydock.yaml's existing
# network/volume create guardrails (deny custom drivers/driver opts by default)
# Container removal additionally permits Compose's force and anonymous-volume
# cleanup controls; legacy link deletion stays denied
# Still denied: /build, /session, /grpc. `docker compose build` / `up --build`
# with default settings never calls POST /build at all — it drives dockerd's
# embedded BuildKit over the hijacked, unversioned /session and /grpc streams
# instead, both denied here. Use drydock-with-mediated-build.yaml if you want
# `--build` support with BuildKit's default (no env var) transport, fully
# mediated (issue #185) rather than opened wholesale. Use drydock-with-build.yaml
# instead if you specifically want the CLASSIC builder (POST /build only,
# requires DOCKER_BUILDKIT=0 in the client). See the Compose/BuildKit
# Transport section of the security model docs for the full breakdown.
# Compose-Spec post_start hooks are also still denied: they run through exec
# (POST /containers/{id}/exec, POST /exec/{id}/start), which the catch-all
# blocks, so drydock's PostStartExecutor fails the deploy loudly rather than
# skipping the hook. Add a pinned allowed_commands entry (modeled on
# drydock-with-selfupdate.yaml) rather than a blanket exec allow if you need it.
# Self-update finalize exec is still denied, same caveat as drydock.yaml;
# combine with drydock-with-selfupdate.yaml by hand if you need both

# Extends drydock-with-compose.yaml with:
# Allows: POST /build — classic builder only, request_body.build left at its
#         secure defaults (allow_remote_context/allow_host_network/
#         allow_run_instructions all false)
# Still denies: /session, /grpc, and any moby.buildkit.v1.Control method path
# — this preset does not open either endpoint, no insecure_accept_opaque_
# buildkit_tunnels acknowledgment (now deprecated) and no request_body.buildkit
# mediation policy. THIS FAILURE IS INTENTIONAL: modern Buildx defaults to
# BuildKit, so a default `docker compose build` against this preset still
# fails with a /session or /grpc denial. Set DOCKER_BUILDKIT=0 in the client
# environment to fall back to the classic builder this preset actually
# supports, or use drydock-with-mediated-build.yaml for the fully-mediated
# BuildKit alternative.

# Extends drydock-with-compose.yaml with:
# Allows: POST /session, POST /grpc — mediated only; request_body.buildkit
#         admits Control.Solve (an "image"-typed exporter, no push registry
#         allowlisted), Control.Info/ListWorkers/Status (worker metadata and
#         ref-owned build progress), and Session.FileSync (REQUIRED — this is
#         how the Dockerfile and context reach buildkitd; still subject to
#         the same RUN-instruction hold-and-inspect scan classic /build gets,
#         since allow_run_instructions stays false)
# request_body.build's three flags stay at their secure defaults
# (allow_remote_context/allow_host_network/allow_run_instructions all false),
# reused verbatim for Solve's own entitlement/frontend checks
# Left denied by default (widen only if you need it): session.auth (base-image
# pulls needing registry auth — exact realm/scope match, no generic default
# covers arbitrary Dockerfiles), session.secrets/ssh (RUN --mount=type=secret/
# ssh), session.file_send/upload (local/tar export, remote/stdin context)
# Still denies: classic POST /build (use drydock-with-build.yaml instead) and
# the literal /moby.buildkit.v1.Control/<Method> probe path (no h2c upgrade
# for any mediator to terminate)
# insecure_accept_opaque_buildkit_tunnels is NOT set — it is deprecated and
# mutually exclusive with request_body.buildkit

# Allows: container read (list, inspect, stats, top, changes, logs)
# Allows: container lifecycle (start, stop, restart, kill, rename, update, wait, create, remove)
# Container removal permits Portwing's force option; anonymous-volume and
# legacy-link deletion stay denied
# Allows: image read, pull, remove
# Allows: network read, volume read, distribution, Swarm service reads
# Denies: exec, build, swarm writes, secrets, plugins, raw archive/export/attach streams
# insecure_allow_read_exfiltration=true — required because GET /containers/*/logs and
# GET /containers/*/top are allowed (Portwing's GetContainerLogs() and process view); logs can
# carry secrets and top returns process command lines. Drop those rules and this
# flag to harden. /containers/*/archive, /export, /attach stay denied (bulk-exfil paths).
# Response redactions disabled (redact_mount_paths=false, redact_container_env=false,
# redact_network_topology=false) — required for drydock passthrough topology so
# inspect data forwarded to drydock is not corrupted by "<redacted>" placeholders
# Standalone operators not paired with drydock can re-enable all three redactions
# deny_verbosity: verbose returns detailed denial reasons to the caller.
# That is safe here because the consumer is the trusted Portwing agent or drydock
# controller. The runner and CIS presets use deny_verbosity: minimal instead.

# Extends portwing.yaml with:
# Allows: POST /containers/{id}/exec, POST /exec/{id}/start,
#         POST /exec/{id}/resize, GET /exec/{id}/json
# Exec body inspection: allow_privileged=false, allow_root_user=true
# (most container workloads run as root; set false + use allowed_commands for
# non-root or command-pinned deployments)
# insecure_allow_body_blind_writes=true — interactive exec can't be pinned to a fixed argv,
# so the body-blind-write guard is bypassed; the allow_privileged/allow_root_user layer still
# applies. insecure_allow_read_exfiltration=true is inherited from portwing.yaml for the
# GET /containers/*/logs rule (see the Portwing section above).

# Extends portwing.yaml with:
# Allows: POST /networks/create, POST /networks/*/connect,
#         POST /networks/*/disconnect, DELETE /networks/*
#         POST /volumes/create, DELETE /volumes/*
# Body inspection for the new endpoints reuses portwing.yaml's existing
# network/volume create guardrails (deny custom drivers/driver opts by default)
# Container removal additionally permits Compose's force and anonymous-volume
# cleanup controls; legacy link deletion stays denied
# Still denied: /build, /session, /grpc. `docker compose build` / `up --build`
# with default settings never calls POST /build at all — it drives dockerd's
# embedded BuildKit over the hijacked, unversioned /session and /grpc streams
# instead, both denied here. Use portwing-with-mediated-build.yaml if you want
# `--build` support with BuildKit's default (no env var) transport, fully
# mediated (issue #185) rather than opened wholesale. Use portwing-with-build.yaml
# instead if you specifically want the CLASSIC builder (POST /build only,
# requires DOCKER_BUILDKIT=0 in the client). See the Compose/BuildKit
# Transport section of the security model docs for the full breakdown.
# insecure_allow_read_exfiltration=true is inherited from portwing.yaml for the
# GET /containers/*/logs rule (see the Portwing section above)
# Exec is denied, same as portwing.yaml — combine with portwing-with-exec.yaml's
# request_body.exec block by hand if you need both compose deploys and exec

# Extends portwing-with-compose.yaml with:
# Allows: POST /build — classic builder only, request_body.build left at its
#         secure defaults (allow_remote_context/allow_host_network/
#         allow_run_instructions all false)
# Still denies: /session, /grpc, and any moby.buildkit.v1.Control method path
# — this preset does not open either endpoint, no insecure_accept_opaque_
# buildkit_tunnels acknowledgment (now deprecated) and no request_body.buildkit
# mediation policy. THIS FAILURE IS INTENTIONAL: modern Buildx defaults to
# BuildKit, so a default `docker compose build` against this preset still
# fails with a /session or /grpc denial. Set DOCKER_BUILDKIT=0 in the client
# environment to fall back to the classic builder this preset actually
# supports, or use portwing-with-mediated-build.yaml for the fully-mediated
# BuildKit alternative.
# insecure_allow_read_exfiltration=true is inherited from portwing.yaml for the
# GET /containers/*/logs rule (see the Portwing section above)

# Extends portwing-with-compose.yaml with:
# Allows: POST /session, POST /grpc — mediated only; request_body.buildkit
#         admits Control.Solve (an "image"-typed exporter, no push registry
#         allowlisted), Control.Info/ListWorkers/Status (worker metadata and
#         ref-owned build progress), and Session.FileSync (REQUIRED — this is
#         how the Dockerfile and context reach buildkitd; still subject to
#         the same RUN-instruction hold-and-inspect scan classic /build gets,
#         since allow_run_instructions stays false)
# request_body.build's three flags stay at their secure defaults
# (allow_remote_context/allow_host_network/allow_run_instructions all false),
# reused verbatim for Solve's own entitlement/frontend checks
# Left denied by default (widen only if you need it): session.auth (base-image
# pulls needing registry auth — exact realm/scope match, no generic default
# covers arbitrary Dockerfiles), session.secrets/ssh (RUN --mount=type=secret/
# ssh), session.file_send/upload (local/tar export, remote/stdin context)
# Still denies: classic POST /build (use portwing-with-build.yaml instead) and
# the literal /moby.buildkit.v1.Control/<Method> probe path (no h2c upgrade
# for any mediator to terminate)
# insecure_allow_read_exfiltration=true is inherited from portwing.yaml for the
# GET /containers/*/logs rule (see the Portwing section above)
# insecure_accept_opaque_buildkit_tunnels is NOT set — it is deprecated and
# mutually exclusive with request_body.buildkit

# Allows: GET container list + inspect, network/service/task lists, node inspect
#         (Swarm), events, ping, version
# Denies: everything else, including container archive/export/logs/attach

# Allows: containers, images, networks, volumes, exec, build, swarm, plugins (full R/W)
# WARNING: This grants near-full Docker socket access
# Container, image, build, network, swarm, node, and plugin writes are inspected, but
# the preset sets insecure_allow_body_blind_writes: true and
# insecure_allow_read_exfiltration: true unconditionally, because Portainer runs
# arbitrary exec and proxies every read endpoint
# request_body.build is fully widened as well (allow_remote_context,
# allow_host_network and allow_run_instructions are all true), so POST /build is
# admitted without the RUN-instruction or remote-context checks the drydock and
# portwing build presets keep, and image_pull.allow_all_registries is true

# Allows: ping/info; container list, inspect, start, stop, rename, update,
#         remove and create; image inspect, pull and remove; lifecycle-hook
#         exec; network connect
# Denies: every unused container/image/network route, all volume and
#         distribution routes, read-exfiltration routes, build, swarm,
#         secrets, configs and plugins

# Allows: GET container list + inspect + stats, service list + inspect and task
#         list (Swarm)
# Denies: all write operations, plus container archive/export/logs/attach and
#         the image-tarball paths GET /images/get and GET /images/*/get

# Allows: GET container list + inspect + stats + logs
# Allows: POST start/stop/restart and DELETE container
# Denies: every other Docker API route, including all image routes

# Allows: GET container list, image inspect, ping, version
# Denies: all other routes. Diun checks registries directly. Container
#         inspect is denied too; Diun's Docker provider never calls it

# Allows: GET /containers/json and GET /containers/*/json (autoheal reads health
#         status from inspect, not from the list), POST /containers/*/restart
# Allows: /_ping (GET and HEAD), GET /version, GET /events (a live stream)
# Denies: everything else — the most restrictive write preset

# Allows: container lifecycle, exec, attach, log streaming (GET /containers/*/logs),
#         image pull, per-job networks, named volumes for cache
# Denies: privileged containers, privileged exec, host namespace sharing, bind mounts,
#         capability additions, build, swarm, secrets, plugins,
#         raw tarball export (/containers/*/export, /images/*/get)
# insecure_allow_body_blind_writes=true — exec argv is not command-pinned (workflow steps are
# arbitrary); only privileged exec is denied. insecure_allow_read_exfiltration=true — the runner
# streams job output via the logs and attach APIs. Gate the proxy socket to the runner process
# via clients.unix_peer_profiles or clients.allowed_cidrs to bound both.

# Allows: container lifecycle, exec, attach, log streaming (GET /containers/*/logs),
#         image pull and image remove (DELETE /images/**, for the runner's
#         post-pipeline cleanup, so a job can delete any image on the host daemon),
#         per-job networks, named volumes
# Denies: privileged containers (even if config.toml asks for them), privileged exec,
#         host namespace sharing, bind mounts, capability additions, build, swarm,
#         secrets, plugins, raw tarball export (/containers/*/export, /images/*/get)
# insecure_allow_body_blind_writes=true — exec argv is not command-pinned; the runner injects
# arbitrary job-step commands. insecure_allow_read_exfiltration=true — job trace output streams
# via the logs and attach APIs. Gate the proxy socket to the runner via clients.unix_peer_profiles
# or clients.allowed_cidrs to bound both.

# Enforces CIS 5.3, 5.4, 5.5, 5.9, 5.10, 5.11, 5.12, 5.15, 5.16, 5.17,
#          5.21, 5.22, 5.23, 5.25, 5.28, 5.30, 5.31 (structural)
# Allows:  container/image/network/volume reads, container lifecycle
# Denies:  exec, build, swarm, secrets, plugins, process-list top,
#          raw archive/log/attach

# Allows: GET on containers, images, networks, volumes, system, events, info, ping, version
# Denies: all POST, PUT, DELETE

# Allows: GET list/inspect/stats/top/changes on containers; list/inspect
#         (+ history on the Docker-compat side) on images; list/inspect
#         only on networks, volumes, secrets — plus pod list/inspect/stats
#         (libpod only) and health/version/info/events, on both surfaces
# Denies: all writes on both surfaces, including libpod-only writes
#         (pod create, play/kube); archive/export/logs/attach/get/push
#         reads on both surfaces; and libpod-only exfiltration reads with
#         no Docker-compat counterpart (mounted-container inventory,
#         generate/kube, manifest push)

services:
  sockguard:
    image: codeswhat/sockguard:latest
    group_add:
      - "${DOCKER_SOCK_GID:?set to the GID of /var/run/docker.sock}"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - sockguard-socket:/var/run/sockguard
    environment:
      - SOCKGUARD_LISTEN_SOCKET=/var/run/sockguard/sockguard.sock
    command: ["serve", "-c", "/etc/sockguard/drydock.yaml"]