From bcb4794eeaa618a29dc28c6cb4090cd8db149bf9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pawe=C5=82=20Gronowski?= Date: Wed, 13 Mar 2024 12:17:37 +0100 Subject: [PATCH] Be more explicit about non-TLS TCP access deprecation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Turn warnings into a deprecation notice and highlight that it will prevent daemon startup in future releases. Signed-off-by: Paweł Gronowski --- cmd/dockerd/daemon.go | 1 + daemon/info.go | 5 +++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/cmd/dockerd/daemon.go b/cmd/dockerd/daemon.go index b81c4bc9b7..6882e4140f 100644 --- a/cmd/dockerd/daemon.go +++ b/cmd/dockerd/daemon.go @@ -844,6 +844,7 @@ func loadListeners(cfg *config.Config, tlsConfig *tls.Config) ([]net.Listener, [ if proto == "tcp" && !authEnabled { log.G(ctx).WithField("host", protoAddr).Warn("Binding to IP address without --tlsverify is insecure and gives root access on this machine to everyone who has access to your network.") log.G(ctx).WithField("host", protoAddr).Warn("Binding to an IP address, even on localhost, can also give access to scripts run in a browser. Be safe out there!") + log.G(ctx).WithField("host", protoAddr).Warn("[DEPRECATION NOTICE] In future versions this will be a hard failure preventing the daemon from starting! Learn more at: https://docs.docker.com/go/api-security/") time.Sleep(time.Second) // If TLSVerify is explicitly set to false we'll take that as "Please let me shoot myself in the foot" diff --git a/daemon/info.go b/daemon/info.go index 14540adee1..8e56bd9a68 100644 --- a/daemon/info.go +++ b/daemon/info.go @@ -241,12 +241,13 @@ func (daemon *Daemon) fillAPIInfo(v *system.Info, cfg *config.Config) { if proto != "tcp" { continue } + const removal = "In future versions this will be a hard failure preventing the daemon from starting! Learn more at: https://docs.docker.com/go/api-security/" if cfg.TLS == nil || !*cfg.TLS { - v.Warnings = append(v.Warnings, fmt.Sprintf("WARNING: API is accessible on http://%s without encryption.%s", addr, warn)) + v.Warnings = append(v.Warnings, fmt.Sprintf("[DEPRECATION NOTICE]: API is accessible on http://%s without encryption.%s\n%s", addr, warn, removal)) continue } if cfg.TLSVerify == nil || !*cfg.TLSVerify { - v.Warnings = append(v.Warnings, fmt.Sprintf("WARNING: API is accessible on https://%s without TLS client verification.%s", addr, warn)) + v.Warnings = append(v.Warnings, fmt.Sprintf("[DEPRECATION NOTICE]: API is accessible on https://%s without TLS client verification.%s\n%s", addr, warn, removal)) continue } }