mirror of
https://github.com/stellarshenson/stellars-jupyterhub-ds.git
synced 2026-03-08 06:00:29 +00:00
d0de218074
Corrected security warnings to accurately describe docker.sock access: - Changed 'host system' to 'Docker host' (docker.sock grants access to Docker daemon, not physical host system) - Applied warning alert style (alert-block alert-warning) to security notes in README.md for better visibility Updated in: - README.md: Two security warnings (Requirements section, Privileged Access) - doc/docker-socket-permissions.md: Security note - .claude/CLAUDE.md: Security warning Security warnings now use HTML alert boxes for emphasis and accurate terminology.
19 lines
725 B
Markdown
19 lines
725 B
Markdown
# Docker Socket Access Control
|
|
|
|
Group-based docker.sock access for user containers. Controlled via `docker-privileged` built-in group.
|
|
|
|
**Implementation** (`config/jupyterhub_config.py`):
|
|
```python
|
|
async def pre_spawn_hook(spawner):
|
|
if any(group.name == 'docker-privileged' for group in spawner.user.groups):
|
|
spawner.volumes['/var/run/docker.sock'] = '/var/run/docker.sock'
|
|
```
|
|
|
|
**Built-in Group**:
|
|
- `BUILTIN_GROUPS = ['docker-privileged']` in config
|
|
- Auto-recreates if deleted (startup script + pre-spawn hook)
|
|
- Managed via admin panel at `/hub/admin` -> Groups
|
|
- User must restart server after membership change
|
|
|
|
**Security**: Docker socket = root-equivalent Docker host access. Only grant to trusted users.
|