Classic confinement request for cot

[jdstrand]

@fnkr

• People might use the non-Snap version of Docker and in this case it wouldn’t be compatible, right? (In fact I don’t know anyone who does use the Docker Snap.) (There are also cases where you can’t use the Snap such as Docker EE.)

There are plans to adjust the docker interface to work with a non-snap docker.

@fnkr

• There is no security benefit: with access to the Docker socket - even if it’s the Snap version of Docker - it’s very easy to escape the sandbox. Just run docker run --rm -it -v /:/host alpine sh and you’ll have access to everything on the host.

Yes, the docker socket is very powerful and we require a similar process for using it as for granting classic (where we typically do not allow auto-connection). Do note that the docker socket is typically protected with traditional unix permissions where you either need to be root to connect to it or be in a specific group (eg, docker). It is also typically easier to maintain a strict mode snap and a strict mode snap can be installed on Ubuntu Core.

Furthermore, the rational that classic is ok since plugging a superprivileged interface like docker, docker-support, lxd, kernel-module-control, etc is not a justification for classic. Classic grants instant full admin access to the snap. Plugging an interface means that auto-connection can be regulated and maintains the user’s voice

@fnkr

• It wouldn’t work together with Podman. While Podman can’t do everything Docker does, it can do many things without root privileges. Podman support gives users the ability to work without root privileges (as said, access to the Docker socket effectively means root). Users would have to use Docker, even in cases where it’s not required, effectively weakening security. Also there is no working Snap version of Podman so far.

It sounds like you would likely need to also plugs the docker-support interface (which would also require a request to use it) to have access to this functionality.

@fnkr

• Access to the Docker socket is limited to the docker group by default. cot will use sudo docker if Docker is used and the current user is not in the docker group. The additional password prompt can increase security, but this wouldn’t work in confined mode.

This is correct, but lack of a sudo prompt is not a reason for classic confinement. Instead of having cot use sudo, you can check if you have access to the socket and then ask the user to rerun the command under sudo.

Based on the information in this request so far, classic does not seem to be required.