policy: enable proxy network from source policy caps#3895
Conversation
Evaluate source policy caps before solve requests so policies can enable
BuildKit proxy networking. Policy can return caps {"exec.proxy": true}
during the caps request to enable proxy network
support for the solve.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
crazy-max
force-pushed
the
exec-proxy-support
branch
from
8cd1c2a to
e08f0fc
Compare
| if err := applyPolicyCaps(ctx, p, bopts, so); err != nil { | ||
| return nil, err | ||
| } | ||
| } |
There was a problem hiding this comment.
I think it could poitentially reject existing policies that never request caps?
Maybe we can treat an undefined or empty decision during caps probing as empty caps?
There was a problem hiding this comment.
If the policies do not define caps then it is as good as having caps false. If one policy requires caps and others don't (explicitly or not) then caps still needed.
| server := httpserver.NewTestServer(map[string]*httpserver.Response{ | ||
| "/file": resp, | ||
| }) | ||
| defer server.Close() | ||
|
|
||
| dockerfile := []byte(` | ||
| FROM busybox:latest | ||
| RUN wget -O- ` + server.URL + `/file | ||
| `) |
There was a problem hiding this comment.
seems to run through the normal build path because server.URL is a loopback/local endpoint. With the new proxy behavior local services are only reachable in the host+proxy case iiuc
not sure if we can have a proxy-reachable non-loopback test endpoint
There was a problem hiding this comment.
This always fails anyway, but test checks that it fails with "policy deny".
Extend testBuildPolicyCapsProxy so that instead of only checking that the network proxy was enabled, the build runs a command that makes an HTTP request to a local test server. The policy denies that URL as an HTTP source, so the test now verifies that exec traffic actually flows through the proxy and is subject to source policy, including the deny message and DENY decision in the build output. Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
tonistiigi
force-pushed
the
exec-proxy-support
branch
from
e08f0fc to
25db0fb
Compare
2 participants
buildx support for moby/buildkit#6740
Evaluate source policy caps before solve requests so policies can enable
BuildKit proxy networking. Policy can return caps {"exec.proxy": true}
during the caps request to enable proxy network
support for the solve.