{"action":"created","comment":{"url":"https://api.github.com/repos/moby/moby/pulls/comments/195927543","pull_request_review_id":129387907,"id":195927543,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDE5NTkyNzU0Mw==","diff_hunk":"@@ -573,9 +574,13 @@ func loadListeners(cli *DaemonCli, serverConfig *apiserver.Config) ([]string, er\n \t\tproto := protoAddrParts[0]\n \t\taddr := protoAddrParts[1]\n \n-\t\t// It's a bad idea to bind to TCP without tlsverify.\n+\t\t// It's a *very* bad idea to bind to TCP without tlsverify.\n \t\tif proto == \"tcp\" && (serverConfig.TLSConfig == nil || serverConfig.TLSConfig.ClientAuth != tls.RequireAndVerifyClientCert) {\n-\t\t\tlogrus.Warn(\"[!] DON'T BIND ON ANY IP ADDRESS WITHOUT setting --tlsverify IF YOU DON'T KNOW WHAT YOU'RE DOING [!]\")\n+\t\t\tif !cli.Config.InsecureHostBind {\n+\t\t\t\treturn nil, fmt.Errorf(\"refusing to bind to an IP address without --tlsverify configured: use --give-the-internet-root-access to ignore this error\")","path":"cmd/dockerd/daemon.go","position":17,"original_position":17,"commit_id":"658cc5c49a7970014531fba7c12b6c42361b3d78","original_commit_id":"658cc5c49a7970014531fba7c12b6c42361b3d78","user":{"login":"cyphar","id":2888411,"node_id":"MDQ6VXNlcjI4ODg0MTE=","avatar_url":"https://avatars1.githubusercontent.com/u/2888411?v=4","gravatar_id":"","url":"https://api.github.com/users/cyphar","html_url":"https://github.com/cyphar","followers_url":"https://api.github.com/users/cyphar/followers","following_url":"https://api.github.com/users/cyphar/following{/other_user}","gists_url":"https://api.github.com/users/cyphar/gists{/gist_id}","starred_url":"https://api.github.com/users/cyphar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cyphar/subscriptions","organizations_url":"https://api.github.com/users/cyphar/orgs","repos_url":"https://api.github.com/users/cyphar/repos","events_url":"https://api.github.com/users/cyphar/events{/privacy}","received_events_url":"https://api.github.com/users/cyphar/received_events","type":"User","site_admin":false},"body":"> This will break existing deployments.\r\n\r\nWell, yes. But I'm not sure how to gracefully deny it -- adding a sleep would not be noticed (people would probably blame systemd) and nobody has noticed the warning message on startup. We could make `docker` (the client) output a warning on each operation but that will also break deployments. (Personally I think it should've been done this way in the first place.)","created_at":"2018-06-17T12:08:26Z","updated_at":"2018-06-17T12:08:26Z","html_url":"https://github.com/moby/moby/pull/37299#discussion_r195927543","pull_request_url":"https://api.github.com/repos/moby/moby/pulls/37299","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/moby/moby/pulls/comments/195927543"},"html":{"href":"https://github.com/moby/moby/pull/37299#discussion_r195927543"},"pull_request":{"href":"https://api.github.com/repos/moby/moby/pulls/37299"}},"in_reply_to_id":195924892},"pull_request":{"url":"https://api.github.com/repos/moby/moby/pulls/37299","id":195329996,"node_id":"MDExOlB1bGxSZXF1ZXN0MTk1MzI5OTk2","html_url":"https://github.com/moby/moby/pull/37299","diff_url":"https://github.com/moby/moby/pull/37299.diff","patch_url":"https://github.com/moby/moby/pull/37299.patch","issue_url":"https://api.github.com/repos/moby/moby/issues/37299","number":37299,"state":"open","locked":false,"title":"dockerd: make -H tcp://... even harder without --tlsverify","user":{"login":"cyphar","id":2888411,"node_id":"MDQ6VXNlcjI4ODg0MTE=","avatar_url":"https://avatars1.githubusercontent.com/u/2888411?v=4","gravatar_id":"","url":"https://api.github.com/users/cyphar","html_url":"https://github.com/cyphar","followers_url":"https://api.github.com/users/cyphar/followers","following_url":"https://api.github.com/users/cyphar/following{/other_user}","gists_url":"https://api.github.com/users/cyphar/gists{/gist_id}","starred_url":"https://api.github.com/users/cyphar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cyphar/subscriptions","organizations_url":"https://api.github.com/users/cyphar/orgs","repos_url":"https://api.github.com/users/cyphar/repos","events_url":"https://api.github.com/users/cyphar/events{/privacy}","received_events_url":"https://api.github.com/users/cyphar/received_events","type":"User","site_admin":false},"body":"Historically we have been a little bit too forgiving to people who run\r\nDocker with an unauthenticated API server, and [recent events][1] have\r\nshown that a worrying amount of people are running Docker daemons with\r\nthe API accessible from the internet.\r\n\r\nFor a long time Docker has not used a TCP port by default, and using it\r\nwithout --tlsverify has elicited an all-caps warning for a while as\r\nwell. But obviously this is not sufficient (maybe people aren't noticing\r\nthe warnings). We cannot just disallow this (because it is in theory\r\npossible to set this up safely, and we use it ourselves in testing), so\r\ninstead add a new flag with a scary name to make sure that users are\r\naware of the significant risk of binding the API server to a TCP port\r\nwithout any authentication:\r\n\r\n  % sudo dockerd -H tcp://0.0.0.0:1337 --give-the-internet-root-access\r\n\r\nWhile it might sound like a bit of a joke, these sorts of \"scary and\r\nvery obvious\" flags exist in other tools. For instance, flashrom\r\nrequires you to use the flag \"i_want_a_brick\" if you are trying to flash\r\na laptop's ROM in a way it doesn't think is safe (and anyone reading\r\nsuch an option should recognise why the flag has such a scary name).\r\n\r\n[1]: https://kromtech.com/blog/security-center/cryptojacking-invades-cloud-how-modern-containerization-trend-is-exploited-by-attackers\r\n\r\n[![Midge our cute new kitten cat by dougwoods](https://farm1.staticflickr.com/202/551399323_da23725ed3_b.jpg)](https://flic.kr/p/QJ4NT)\r\n\r\n###### [Midge our cute new kitten cat](https://flic.kr/p/QJ4NT) by [dougwoods](https://www.flickr.com/photos/deerwooduk/)\r\n\r\nRef: docker/hub-feedback#1121\r\nSigned-off-by: Aleksa Sarai <asarai@suse.de>\r\n","created_at":"2018-06-16T12:08:25Z","updated_at":"2018-06-17T12:08:26Z","closed_at":null,"merged_at":null,"merge_commit_sha":"a5ab6aff524665865b33f6e287ad6be8570bea80","assignee":null,"assignees":[],"requested_reviewers":[{"login":"vdemeester","id":6508,"node_id":"MDQ6VXNlcjY1MDg=","avatar_url":"https://avatars0.githubusercontent.com/u/6508?v=4","gravatar_id":"","url":"https://api.github.com/users/vdemeester","html_url":"https://github.com/vdemeester","followers_url":"https://api.github.com/users/vdemeester/followers","following_url":"https://api.github.com/users/vdemeester/following{/other_user}","gists_url":"https://api.github.com/users/vdemeester/gists{/gist_id}","starred_url":"https://api.github.com/users/vdemeester/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vdemeester/subscriptions","organizations_url":"https://api.github.com/users/vdemeester/orgs","repos_url":"https://api.github.com/users/vdemeester/repos","events_url":"https://api.github.com/users/vdemeester/events{/privacy}","received_events_url":"https://api.github.com/users/vdemeester/received_events","type":"User","site_admin":false}],"requested_teams":[],"labels":[{"id":237471977,"node_id":"MDU6TGFiZWwyMzc0NzE5Nzc=","url":"https://api.github.com/repos/moby/moby/labels/area/security","name":"area/security","color":"fbca04","default":false},{"id":237472270,"node_id":"MDU6TGFiZWwyMzc0NzIyNzA=","url":"https://api.github.com/repos/moby/moby/labels/impact/changelog","name":"impact/changelog","color":"bfe5bf","default":false},{"id":175374554,"node_id":"MDU6TGFiZWwxNzUzNzQ1NTQ=","url":"https://api.github.com/repos/moby/moby/labels/status/0-triage","name":"status/0-triage","color":"EEEEEE","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/moby/moby/pulls/37299/commits","review_comments_url":"https://api.github.com/repos/moby/moby/pulls/37299/comments","review_comment_url":"https://api.github.com/repos/moby/moby/pulls/comments{/number}","comments_url":"https://api.github.com/repos/moby/moby/issues/37299/comments","statuses_url":"https://api.github.com/repos/moby/moby/statuses/658cc5c49a7970014531fba7c12b6c42361b3d78","head":{"label":"cyphar:make-binding-to-tcp-harder","ref":"make-binding-to-tcp-harder","sha":"658cc5c49a7970014531fba7c12b6c42361b3d78","user":{"login":"cyphar","id":2888411,"node_id":"MDQ6VXNlcjI4ODg0MTE=","avatar_url":"https://avatars1.githubusercontent.com/u/2888411?v=4","gravatar_id":"","url":"https://api.github.com/users/cyphar","html_url":"https://github.com/cyphar","followers_url":"https://api.github.com/users/cyphar/followers","following_url":"https://api.github.com/users/cyphar/following{/other_user}","gists_url":"https://api.github.com/users/cyphar/gists{/gist_id}","starred_url":"https://api.github.com/users/cyphar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cyphar/subscriptions","organizations_url":"https://api.github.com/users/cyphar/orgs","repos_url":"https://api.github.com/users/cyphar/repos","events_url":"https://api.github.com/users/cyphar/events{/privacy}","received_events_url":"https://api.github.com/users/cyphar/received_events","type":"User","site_admin":false},"repo":{"id":19424861,"node_id":"MDEwOlJlcG9zaXRvcnkxOTQyNDg2MQ==","name":"docker","full_name":"cyphar/docker","owner":{"login":"cyphar","id":2888411,"node_id":"MDQ6VXNlcjI4ODg0MTE=","avatar_url":"https://avatars1.githubusercontent.com/u/2888411?v=4","gravatar_id":"","url":"https://api.github.com/users/cyphar","html_url":"https://github.com/cyphar","followers_url":"https://api.github.com/users/cyphar/followers","following_url":"https://api.github.com/users/cyphar/following{/other_user}","gists_url":"https://api.github.com/users/cyphar/gists{/gist_id}","starred_url":"https://api.github.com/users/cyphar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cyphar/subscriptions","organizations_url":"https://api.github.com/users/cyphar/orgs","repos_url":"https://api.github.com/users/cyphar/repos","events_url":"https://api.github.com/users/cyphar/events{/privacy}","received_events_url":"https://api.github.com/users/cyphar/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/cyphar/docker","description":"Docker - the open-source application container engine","fork":true,"url":"https://api.github.com/repos/cyphar/docker","forks_url":"https://api.github.com/repos/cyphar/docker/forks","keys_url":"https://api.github.com/repos/cyphar/docker/keys{/key_id}","collaborators_url":"https://api.github.com/repos/cyphar/docker/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/cyphar/docker/teams","hooks_url":"https://api.github.com/repos/cyphar/docker/hooks","issue_events_url":"https://api.github.com/repos/cyphar/docker/issues/events{/number}","events_url":"https://api.github.com/repos/cyphar/docker/events","assignees_url":"https://api.github.com/repos/cyphar/docker/assignees{/user}","branches_url":"https://api.github.com/repos/cyphar/docker/branches{/branch}","tags_url":"https://api.github.com/repos/cyphar/docker/tags","blobs_url":"https://api.github.com/repos/cyphar/docker/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/cyphar/docker/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/cyphar/docker/git/refs{/sha}","trees_url":"https://api.github.com/repos/cyphar/docker/git/trees{/sha}","statuses_url":"https://api.github.com/repos/cyphar/docker/statuses/{sha}","languages_url":"https://api.github.com/repos/cyphar/docker/languages","stargazers_url":"https://api.github.com/repos/cyphar/docker/stargazers","contributors_url":"https://api.github.com/repos/cyphar/docker/contributors","subscribers_url":"https://api.github.com/repos/cyphar/docker/subscribers","subscription_url":"https://api.github.com/repos/cyphar/docker/subscription","commits_url":"https://api.github.com/repos/cyphar/docker/commits{/sha}","git_commits_url":"https://api.github.com/repos/cyphar/docker/git/commits{/sha}","comments_url":"https://api.github.com/repos/cyphar/docker/comments{/number}","issue_comment_url":"https://api.github.com/repos/cyphar/docker/issues/comments{/number}","contents_url":"https://api.github.com/repos/cyphar/docker/contents/{+path}","compare_url":"https://api.github.com/repos/cyphar/docker/compare/{base}...{head}","merges_url":"https://api.github.com/repos/cyphar/docker/merges","archive_url":"https://api.github.com/repos/cyphar/docker/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/cyphar/docker/downloads","issues_url":"https://api.github.com/repos/cyphar/docker/issues{/number}","pulls_url":"https://api.github.com/repos/cyphar/docker/pulls{/number}","milestones_url":"https://api.github.com/repos/cyphar/docker/milestones{/number}","notifications_url":"https://api.github.com/repos/cyphar/docker/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/cyphar/docker/labels{/name}","releases_url":"https://api.github.com/repos/cyphar/docker/releases{/id}","deployments_url":"https://api.github.com/repos/cyphar/docker/deployments","created_at":"2014-05-04T11:14:30Z","updated_at":"2016-01-15T12:08:46Z","pushed_at":"2018-06-17T07:25:04Z","git_url":"git://github.com/cyphar/docker.git","ssh_url":"git@github.com:cyphar/docker.git","clone_url":"https://github.com/cyphar/docker.git","svn_url":"https://github.com/cyphar/docker","homepage":"http://www.docker.io","size":130701,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":1,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0","node_id":"MDc6TGljZW5zZTI="},"forks":1,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"moby:master","ref":"master","sha":"de0abf4315fd1d737aedc2e9f410c8125ad1a7fc","user":{"login":"moby","id":27259197,"node_id":"MDEyOk9yZ2FuaXphdGlvbjI3MjU5MTk3","avatar_url":"https://avatars1.githubusercontent.com/u/27259197?v=4","gravatar_id":"","url":"https://api.github.com/users/moby","html_url":"https://github.com/moby","followers_url":"https://api.github.com/users/moby/followers","following_url":"https://api.github.com/users/moby/following{/other_user}","gists_url":"https://api.github.com/users/moby/gists{/gist_id}","starred_url":"https://api.github.com/users/moby/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/moby/subscriptions","organizations_url":"https://api.github.com/users/moby/orgs","repos_url":"https://api.github.com/users/moby/repos","events_url":"https://api.github.com/users/moby/events{/privacy}","received_events_url":"https://api.github.com/users/moby/received_events","type":"Organization","site_admin":false},"repo":{"id":7691631,"node_id":"MDEwOlJlcG9zaXRvcnk3NjkxNjMx","name":"moby","full_name":"moby/moby","owner":{"login":"moby","id":27259197,"node_id":"MDEyOk9yZ2FuaXphdGlvbjI3MjU5MTk3","avatar_url":"https://avatars1.githubusercontent.com/u/27259197?v=4","gravatar_id":"","url":"https://api.github.com/users/moby","html_url":"https://github.com/moby","followers_url":"https://api.github.com/users/moby/followers","following_url":"https://api.github.com/users/moby/following{/other_user}","gists_url":"https://api.github.com/users/moby/gists{/gist_id}","starred_url":"https://api.github.com/users/moby/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/moby/subscriptions","organizations_url":"https://api.github.com/users/moby/orgs","repos_url":"https://api.github.com/users/moby/repos","events_url":"https://api.github.com/users/moby/events{/privacy}","received_events_url":"https://api.github.com/users/moby/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/moby/moby","description":"Moby Project - a collaborative project for the container ecosystem to assemble container-based systems","fork":false,"url":"https://api.github.com/repos/moby/moby","forks_url":"https://api.github.com/repos/moby/moby/forks","keys_url":"https://api.github.com/repos/moby/moby/keys{/key_id}","collaborators_url":"https://api.github.com/repos/moby/moby/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/moby/moby/teams","hooks_url":"https://api.github.com/repos/moby/moby/hooks","issue_events_url":"https://api.github.com/repos/moby/moby/issues/events{/number}","events_url":"https://api.github.com/repos/moby/moby/events","assignees_url":"https://api.github.com/repos/moby/moby/assignees{/user}","branches_url":"https://api.github.com/repos/moby/moby/branches{/branch}","tags_url":"https://api.github.com/repos/moby/moby/tags","blobs_url":"https://api.github.com/repos/moby/moby/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/moby/moby/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/moby/moby/git/refs{/sha}","trees_url":"https://api.github.com/repos/moby/moby/git/trees{/sha}","statuses_url":"https://api.github.com/repos/moby/moby/statuses/{sha}","languages_url":"https://api.github.com/repos/moby/moby/languages","stargazers_url":"https://api.github.com/repos/moby/moby/stargazers","contributors_url":"https://api.github.com/repos/moby/moby/contributors","subscribers_url":"https://api.github.com/repos/moby/moby/subscribers","subscription_url":"https://api.github.com/repos/moby/moby/subscription","commits_url":"https://api.github.com/repos/moby/moby/commits{/sha}","git_commits_url":"https://api.github.com/repos/moby/moby/git/commits{/sha}","comments_url":"https://api.github.com/repos/moby/moby/comments{/number}","issue_comment_url":"https://api.github.com/repos/moby/moby/issues/comments{/number}","contents_url":"https://api.github.com/repos/moby/moby/contents/{+path}","compare_url":"https://api.github.com/repos/moby/moby/compare/{base}...{head}","merges_url":"https://api.github.com/repos/moby/moby/merges","archive_url":"https://api.github.com/repos/moby/moby/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/moby/moby/downloads","issues_url":"https://api.github.com/repos/moby/moby/issues{/number}","pulls_url":"https://api.github.com/repos/moby/moby/pulls{/number}","milestones_url":"https://api.github.com/repos/moby/moby/milestones{/number}","notifications_url":"https://api.github.com/repos/moby/moby/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/moby/moby/labels{/name}","releases_url":"https://api.github.com/repos/moby/moby/releases{/id}","deployments_url":"https://api.github.com/repos/moby/moby/deployments","created_at":"2013-01-18T18:10:57Z","updated_at":"2018-06-17T10:10:41Z","pushed_at":"2018-06-17T07:25:07Z","git_url":"git://github.com/moby/moby.git","ssh_url":"git@github.com:moby/moby.git","clone_url":"https://github.com/moby/moby.git","svn_url":"https://github.com/moby/moby","homepage":"https://mobyproject.org/","size":135925,"stargazers_count":49249,"watchers_count":49249,"language":"Go","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":14395,"mirror_url":null,"archived":false,"open_issues_count":3218,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0","node_id":"MDc6TGljZW5zZTI="},"forks":14395,"open_issues":3218,"watchers":49249,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/moby/moby/pulls/37299"},"html":{"href":"https://github.com/moby/moby/pull/37299"},"issue":{"href":"https://api.github.com/repos/moby/moby/issues/37299"},"comments":{"href":"https://api.github.com/repos/moby/moby/issues/37299/comments"},"review_comments":{"href":"https://api.github.com/repos/moby/moby/pulls/37299/comments"},"review_comment":{"href":"https://api.github.com/repos/moby/moby/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/moby/moby/pulls/37299/commits"},"statuses":{"href":"https://api.github.com/repos/moby/moby/statuses/658cc5c49a7970014531fba7c12b6c42361b3d78"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"cyphar"}}