fix(#54): talk to docker-socket-proxy's exposed socket, not the raw host one - #3
Merged
Merged
Conversation
…ost one omnibioai-studio's docker-compose*.yml no longer mounts /var/run/docker.sock into this service directly (companion #54 PR) -- it mounts the docker-proxy-socket named volume at /var/run/proxy-socket instead, the same policy-enforcing proxy already in front of workbench's own socket access since #265. dockerRequest() hardcoded socketPath: '/var/run/docker.sock' with no DOCKER_HOST-style environment indirection to redirect through (this is a raw Node http.request over a Unix socket, not the docker CLI or SDK). Added a DOCKER_SOCKET_PATH env var, defaulting to the proxy's own path so this keeps working even if the var is unset somewhere this service runs outside that compose file. This service's real docker.sock usage is exactly three calls on three fixed, hardcoded container names (omnibioai-jupyter/-rstudio/-vscode): GET .../json, POST .../start, POST .../stop -- never /containers/create, so no docker-socket-proxy allowlist changes were needed on its side. Testing: src/server.test.js, all 4 tests passing (mocked at the http module level; none assert on the literal socketPath value). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CBywKuCSWEuBHMv7DPAUCE
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fix(#54): talk to docker-socket-proxy's exposed socket, not the raw host one
omnibioai-studio's docker-compose*.yml no longer mounts /var/run/docker.sock
into this service directly (companion #54 PR) -- it mounts the
docker-proxy-socket named volume at /var/run/proxy-socket instead, the
same policy-enforcing proxy already in front of workbench's own socket
access since #265.
dockerRequest() hardcoded socketPath: '/var/run/docker.sock' with no
DOCKER_HOST-style environment indirection to redirect through (this is a
raw Node http.request over a Unix socket, not the docker CLI or SDK).
Added a DOCKER_SOCKET_PATH env var, defaulting to the proxy's own path so
this keeps working even if the var is unset somewhere this service runs
outside that compose file.
This service's real docker.sock usage is exactly three calls on three
fixed, hardcoded container names (omnibioai-jupyter/-rstudio/-vscode):
GET .../json, POST .../start, POST .../stop -- never /containers/create,
so no docker-socket-proxy allowlist changes were needed on its side.
Testing: src/server.test.js, all 4 tests passing (mocked at the http
module level; none assert on the literal socketPath value).
Co-Authored-By: Claude Sonnet 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01CBywKuCSWEuBHMv7DPAUCE