[Feature Request] Docker Support

[rauchenwaldc (Christian Rauchenwald)]

Thanks again for your reply. I really appreciate you taking the time to explain your side.

@pmueller

Docker containers share their kernel with the host system (that’s the difference between a container and a VM), which is a huge security risk especially when it comes to kernel functionality commonly needed, such as user namespaces.

But that’s only an issue if the docker container itself is “malicious” or not?

@pmueller

Second, running additional services on the same machine is - in terms of security - bad by principle.
(Not to mention the general discussion why those services need to run on a firewall…)

That argument could probably be made for the majority of services that currently can be added through Pakfire?
And that’s where I disagree to some extend.

Yes, if I’d use my ipfire to protect my companies network setting up additional services on separate machines within DMZ makes sense.
However, I’m sure there are plenty ipfire users like me that use ipfire as firewall in their private network and there budgets usually are different. So buying and running dedicated hardware for everything just isn’t an option.
Giving users the freedom to decide what else they want to run would make sense IMHO.

@pmueller

Container environments in general and Docker in particular are fragile, interfere with other host configurations.

@teejay

Better use Podman where you do not need root to run containers.

Thanks @teejay for the tip. I haven’t heard about Podman so far, but it really looks like a great alternative to Docker.

@pmueller I get that even Podman would share the kernel with the host, but since ipfire is using a “sealed kernel” as explained in the blog post you linked I don’t see why/how that could cause an issue?
Adding Docker (or Podman) support to ipfire would leave it up to the user if/which containers a user wants to run on ipfire.
In cases like mine, where ipfire is used to secure a personal network and neither the budget nor the infrastructure exists to add new machines it would grant me and others more flexibility.

In my specific case, I’d need docker support to run the following things on the same machine (since it’s the only machine running 24/7 in my house):

• STORJ Node (to benefit from HDDs that I’m not using and basically make a small profit from having my ipfire run 24/7)
• Pi Network Node
• PostgreSQL (to host my PokerTracker4 DB)

@pmueller

Because we would be able to put an add-on into a container, we still have to maintain it (plus maintain the container technology, which actually means extra work).

Why? Wouldn’t it be enough in that case to maintain the Docker/Podman integration? It’s up to the user then to decide which container he/she installs and if Docker/Podman runs on the host I don’t understand/see why you’d need to maintain any of the images/apps that can run in those containers?

Maybe I’m wrong here, but wouldn’t the work on your end only consist of adding Docker/Podman support to the distro and in an ideal case add a section to the IPFire GUI to see which images are running + maybe (not sure if it can be done) set up a “zone” to manage which ports should be open for Docker?

@pmueller

I am absolutely against allowing IPFire users to run arbitrary (i. e. untrusted) Docker containers on their systems.

Shouldn’t that be up to the user? Unless adding Docker/Podman support itself to ipfire would automatically cause security issues, it would then be up to the user to decide if/which service he/she wants to run on their machine as well.

I still believe that it would mean more flexibility for the users combined with less effort for developers. No need to verify ever docker image, simply add a confirmation dialog or huge tooltip that points out potential risks?

Overall I’m sure there are many ipfire feature requests that would be solved this way.