Skip to content

Fix a few typos in the ECI docs. #21538

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Dec 2, 2024
Merged

Fix a few typos in the ECI docs. #21538

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7f84a9b
Fix a few typos in the ECI docs.
ctalledo Nov 30, 2024
88f9286
ECI: fix error regarding default value of allowDerivedImages in docs.
ctalledo Nov 30, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 19 additions & 11 deletions ...als/security/for-admins/hardened-desktop/enhanced-container-isolation/config.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,8 @@
"docker.io/localstack/localstack:*",
"docker.io/testcontainers/ryuk:*",
"docker:cli"
]
],
"allowDerivedImages": true
},
"commandList": {
"type": "deny",
Expand Down Expand Up @@ -119,9 +120,9 @@
Docker Desktop checks if the container's image digest matches one of the allowed
digests. If so, the container is allowed to start, otherwise it's blocked.

Due to the digest comparison, it's not possible to bypass the Docker socket mount permissions by re-tagging a
disallowed image to the name of an allowed one. In other words, if a user
does:
Due to the digest comparison, it's not possible to bypass the Docker socket
mount permissions by re-tagging a disallowed image to the name of an allowed
one. In other words, if a user does:

```console
$ docker image rm <allowed_image>
Expand All @@ -135,7 +136,7 @@

### Docker Socket Mount Permissions for derived images

{{ introduced desktop 4.34.0 "../../../../desktop/release-notes.md#4340" }}
{{< introduced desktop 4.34.0 "../../../../desktop/release-notes.md#4340" >}}

As described in the prior section, administrators can configure the list of container
images that are allowed to mount the Docker socket via the `imageList`.
Expand All @@ -162,7 +163,7 @@
```json
"imageList": {
"images": [
"paketobuildpacks/builder:base",
"paketobuildpacks/builder:base"
],
"allowDerivedImages": true
}
Expand All @@ -173,12 +174,15 @@
allow this because it will notice that the ephemeral image is derived from an
allowed image.

The behavior is enabled by default. It can be disabled by setting
`allowDerivedImages=false` in the `admin-settings.json` file. In general it is
not recommended that you disable this setting unless you know it won't be
required.
The behavior is disabled by default and must be explicitly enabled by setting
`"allowDerivedImages": true` as shown above. In general it is recommended that

Check warning on line 178 in content/manuals/security/for-admins/hardened-desktop/enhanced-container-isolation/config.md

View workflow job for this annotation

GitHub Actions / vale 

[vale] reported by reviewdog 🐶
[Docker.RecommendedWords] Consider using 'previous' instead of 'above'

Raw Output:
{"message": "[Docker.RecommendedWords] Consider using 'previous' instead of 'above'", "location": {"path": "content/manuals/security/for-admins/hardened-desktop/enhanced-container-isolation/config.md", "range": {"start": {"line": 178, "column": 39}}}, "severity": "INFO"}
you disable this setting unless you know it's required.

A couple of caveats:
A few caveats:

* Setting `"allowedDerivedImages" :true` will impact the startup time of
containers by up to 1 extra second, as Docker Desktop needs to perform
some more checks on the container image.

* The `allowDerivedImages` setting only applies to local-only images built from
an allowed image. That is, the derived image must not be present in a remote
Expand Down Expand Up @@ -211,6 +215,10 @@
}
```

This tells Docker Desktop to allow all containers to mount the Docker socket

Check warning on line 218 in content/manuals/security/for-admins/hardened-desktop/enhanced-container-isolation/config.md

View workflow job for this annotation

GitHub Actions / vale 

[vale] reported by reviewdog 🐶
[Docker.RecommendedWords] Consider using 'let' instead of 'allow'

Raw Output:
{"message": "[Docker.RecommendedWords] Consider using 'let' instead of 'allow'", "location": {"path": "content/manuals/security/for-admins/hardened-desktop/enhanced-container-isolation/config.md", "range": {"start": {"line": 218, "column": 30}}}, "severity": "INFO"}
which increases flexibility but reduces security. It also improves container
startup time when using Enhanced Container Isolation.

It is recommended that you use this only in scenarios where explicitly listing
allowed container images is not flexible enough.

Expand Down