Skip to content
Snippets Groups Projects
Commit 5a7bc8fd authored by Andre Zoledziowski's avatar Andre Zoledziowski Committed by Jairo Llopis
Browse files

Added explicit "allow restarts" permission.

parent 3a1d5bb0
No related branches found
No related tags found
No related merge requests found
Show whitespace changes
Inline Side-by-side
Dockerfile
+ 2
− 1
View file @ 5a7bc8fd
FROM haproxy:1.9-alpine FROM haproxy:1.9-alpine
EXPOSE 2375 EXPOSE 2375
ENV AUTH=0 \ ENV ALLOW_RESTARTS=0 \
AUTH=0 \
BUILD=0 \ BUILD=0 \
COMMIT=0 \ COMMIT=0 \
CONFIGS=0 \ CONFIGS=0 \
......
haproxy.cfg
+ 1
− 0
View file @ 5a7bc8fd
...@@ -42,6 +42,7 @@ backend dockerbackend ...@@ -42,6 +42,7 @@ backend dockerbackend
frontend dockerfrontend frontend dockerfrontend
bind :2375 bind :2375
http-request deny unless METH_GET || { env(POST) -m bool } http-request deny unless METH_GET || { env(POST) -m bool }
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/[^/]+/((stop)|(restart)|(kill)) } ! { env(ALLOW_RESTARTS) -m bool }
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?/auth } ! { env(AUTH) -m bool } http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?/auth } ! { env(AUTH) -m bool }
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?/build } ! { env(BUILD) -m bool } http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?/build } ! { env(BUILD) -m bool }
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?/commit } ! { env(COMMIT) -m bool } http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?/commit } ! { env(COMMIT) -m bool }
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment