Implement entitlement security.unconfined

[andrewrynhard]

I would like to run privileged commands in my builds. I saw the --allow security.unconfined flag, but seeing the following when using it:

2019/04/19 05:28:51 http2: server connection error from localhost: connection error: PROTOCOL_ERROR
error: failed to solve: rpc error: code = Unknown desc = entitlement security.unconfined is not allowed
Makefile:158: recipe for target 'test' failed
make: *** [test] Error 1

[andrewrynhard]

@AkihiroSuda Are there any blockers to starting work on this? I wouldn't mind contributing.

[AkihiroSuda]

cc @kunalkushwaha

[kunalkushwaha]

@andrewrynhard please try security.insecure instead of security.unconfined

[andrewrynhard]

@kunalkushwaha

error: unknown entitlement security.insecure

Not in the latest release?

[kunalkushwaha]

is buildkitd running with --allow-insecure-entitlement security.insecure. By default it is disabled.

This feature is available with master branch. #570

[andrewrynhard]

I am not. Looks like I need to build from master

[kunalkushwaha]

Also, No frontend support is added to it yet, So using dockerfile, this cannot be used at this moment.

[andrewrynhard]

Also, No frontend support is added to it yet, So using dockerfile, this cannot be used at this moment.

Are there examples of other ways I can use it?

[andrewrynhard]

And is there a timeline on when I can use it with the docker frontend?

[kunalkushwaha]

@andrewrynhard you can see an example here https://gist.github.com/kunalkushwaha/775b063671a62f968ff111d266764d04

Also, you can refer to tests https://github.com/moby/buildkit/blob/master/client/client_test.go#L439

And is there a timeline on when I can use it with the docker frontend?

@tonistiigi @AkihiroSuda can be in better people to tell this, since it requires to add New Dockerfile command

[andrewrynhard]

@kunalkushwaha I’d be happy to implement this for the docker frontend, but I’m afraid I’m not familiar with the code base yet. If you can give me a brief outline of the steps needed for the docker frontend, I could give it a shot.

EDIT: I posted this just after your response. Thanks for the help!

[tonistiigi]

We first need a design proposal and to agree on the syntax for the Dockerfile. (out of tree you can experiment on your own of course).

For examples, it probably makes sense to look up PRs that added things like mounts, secrets or ssh to dockerfile frontend. Eg. https://github.com/moby/buildkit/pull/655/files

Also, I believe there isn't currently a way to enable the daemon level allow rules in Moby. It might be good to push that so it may still get into 19.03 (cc @kunalkushwaha )

[kunalkushwaha]

Also, I believe there isn't currently a way to enable the daemon level allow rules in Moby. It might be >good to push that so it may still get into 19.03 (cc @kunalkushwaha )

@tonistiigi currently EntilementNetworkHost is enabled by default for builder in Moby. Which may not be great idea for enabling SecurityInsecure entitlement.

We can add allow-insecure-entitlement in BuilderConfig, which can read from docker daemon config. Will NetworkHost should also be configurable like that?

Please share views.

//cc @tiborvass

[tonistiigi]

If we don't add EntilementNetworkHost automatically we would break the old --net=host behavior (that wasn't a very brilliant idea when it was added). In some way, it would make sense to just enable securityinsecure as well(old builder allows disabling security profiles from client for example) but I guess we could use config to be on the safe side.

Maybe add key: bool in the config. Net host can be on by default but the user can set it to false if they want.