fix(infra): restrict Docker API proxy to whitelist only

2026-07-22 18:20:11 +07:00
parent 46314e6d38
commit 1ee99ffc2c
1 changed files with 16 additions and 3 deletions
@@ -66,13 +66,26 @@ http {
            proxy_read_timeout 5s;
        }

-        # Docker API proxy (read-only Unix socket)
-        location /api/docker/ {
-            proxy_pass http://unix:/var/run/docker.sock:/;
+        # Docker API proxy — strict whitelist (read-only Unix socket)
+        # Uses exact match (=) to avoid regex+proxy_pass URI limitation.
+        location = /api/docker/containers/json {
+            proxy_pass http://unix:/var/run/docker.sock:/containers/json;
            proxy_set_header Host $host;
            proxy_read_timeout 10s;
        }

+        location = /api/docker/version {
+            proxy_pass http://unix:/var/run/docker.sock:/version;
+            proxy_set_header Host $host;
+            proxy_read_timeout 10s;
+        }
+
+        # Deny all other Docker API access
+        location /api/docker/ {
+            deny all;
+            return 403;
+        }
+
        # Static files
        location / {
            try_files $uri $uri/ /index.html;