docker-socket-proxy: CONTAINERS access lets any client export container filesystems and read files

Impact

docker-socket-proxy exists to hand a narrowed view of the Docker socket to sidecars such as reverse proxies and monitoring agents, so operators treat whatever it allows as the security boundary. With the CONTAINERS environment variable set, that boundary leaks far more than container metadata: GET /containers/{id}/archive reads arbitrary files out of a container, /export downloads an entire container filesystem as a tar archive, and /logs and /top expose runtime output and process lists. On a shared GPU host that means model weights, API tokens, kubeconfigs and .env secrets belonging to every co-tenant container on the node can be pulled out through a component the operator believed was read-only and harmless. Nothing about the flaw is GPU-specific, but it is worst where one node hosts several tenants' workloads.

Who can reach it

Anyone who can reach the proxy's HTTP listener. By design that is the container network the proxy is attached to, so any workload sharing that network qualifies. No authentication is required - docker-socket-proxy has no auth of its own and relies entirely on the endpoint allow-list.

What to do

The record cites an upstream issue and pull request but names no fixed release, so treat this as configuration mitigation for now: unset CONTAINERS if the consumer does not need it, and move the proxy onto a dedicated network reachable only by that one consumer. Applying either change means recreating or restarting the proxy container, which is cheap - no GPU workload interruption, no node drain. Re-check the project's releases before assuming a patched version exists.

References

Related entries

• Kubernetes (kubelet): /debug/pprof exposed on the unauthenticated kubelet healthz portCVE-2019-11248 · Kubernetes (kubelet)High
• Envoy: JWT with an issuer absent from the provider list bypasses JWT authenticationCVE-2021-21378 · EnvoyHigh
• KubeVirt: A compromised node's virt-handler service account can be abused cluster-wideCVE-2023-26484 · KubeVirtHigh
• Envoy: Client can forge the x-envoy-original-path header and bypass JWT checksCVE-2023-27487 · EnvoyHigh
• Envoy: Mixed-case HTTP/2 schemes defeat case-sensitive internal scheme checksCVE-2023-35944 · EnvoyHigh
• Slurm: A user can modify their extended group list used by sbcast and open files with unauthorized permissionsCVE-2023-49938 · SlurmHigh