[MYDIH]

Hi !

In the process of hardening my stack, I dropped all capacities on this tool, only enabling the ones needed. While CHOWN, SETUID, SETGID makes sense considering what the container is doing, DAC_OVERRIDE feels less required. It is needed for now since the healthcheck is trying to access the unprivileged socket using the image user (which is root:docker comonly vs 1000:1000).

This fix also drops to the unprivileged user on the healthcheck path to allow the removal of the DAC_OVERRIDE capability

After the fix, an hardened compose snippet could look like

socket-proxy:
  image: 11notes/socket-proxy
  network_mode: none
  read_only: true
  restart: always
  user: 0:970 # docker group
  volumes:
    - type: volume
      source: socket-proxy.run
      target: /run/proxy
    - type: bind
      source: /run/docker.sock
      target: /run/docker.sock
      read_only: true
  security_opt:
    - no-new-privileges:true
  cap_drop:
    - ALL
  cap_add:
    # Image is dropping privilege asap
    - SETUID
    - SETGID
    - CHOWN
  deploy:
    resources:
      limits:
        pids: 100

Thx