Using Docker socket proxy with Authentik worker and understanding docker.sock access requirements

[n0one42]

Hello everyone,

I have been setting up Authentik in my environment and noticed that the Authentik worker container requires direct access to the Docker socket by mounting /var/run/docker.sock. While this is a common practice, it can have some security implications, as the container gains extensive privileges on the host system.

To mitigate this risk, I would like to know if it's possible to use a Docker socket proxy, such as tecnativa/docker-socket-proxy, with the Authentik worker container. This proxy would limit the Docker API access and provide better security.

I have already set up a similar configuration for Traefik command: --providers.docker.endpoint=tcp://traefik-socketproxy:2375 and Portainer command: -H tcp://portainer-socketproxy:2375.
My Ansible task for setting up Authentik can be found here:
ansible-playbook-homelab - container_authentik.yml

Additionally, I would like to understand why the Authentik worker requires access to the Docker socket. What specific features or functionality does it provide that necessitate this access?

I couldn't find any references to configuring a custom Docker socket or using a DOCKER_HOST environment variable in the Authentik documentation or source code. Could you please provide some guidance on whether it's possible to use a socket proxy with Authentik worker and, if so, how to configure it correctly?

I appreciate any help or suggestions you can provide on this topic. Thank you in advance for your time and support.

[BeryJu]

The docker socket bind is not required and can be removed as the compose file states. The reason why it's in there by default is to allow the creation for authentik managed outposts, where authentik creates the container and keeps it updated.

There was another issue that I can't find right now that lists what access is required for this integration when using an API proxy

You can connect to a different docker API endpoint by creating an outpost integration in the admin interface under system, where you can specify tcp://my-server and then use that for outposts

[n0one42]

Many thanks for the fast response!

I created the outpost under Outpost → "Docker Service-Connection" and inserted tcp://authentik-socketproxy:2375. The full configuration is as follows:

{
  "pk": "random-pk",
  "name": "authentik-socketproxy",
  "local": true,
  "component": "ak-service-connection-docker-form",
  "verbose_name": "Docker Service-Connection",
  "verbose_name_plural": "Docker Service-Connections",
  "meta_model_name": "authentik_outposts.dockerserviceconnection",
  "url": "tcp://authentik-socketproxy:2375",
  "tls_verification": null,
  "tls_authentication": null
}

I tried local: true and local: false. Only with local: false do I get an entry inside the socket proxy, but it gives:

172.27.0.3:34764 [30/Apr/2023:07:10:53.448] dockerfrontend dockerfrontend/<NOSRV> -1/-1/-1/-1/0 400 188 - - PR-- 1/1/0/0/0 0/0 "<BADREQ>"

For testing purposes, I've granted the socket proxy full access permissions.

---

offtopic
Vielen Dank für die Hilfe! Ich bin beeindruckt, wie gut strukturiert alles aussieht. Es ist selten, so gut durchdachte Projekte zu sehen, weshalb ich Authentik gerne eine Chance gegenüber Keycloak geben möchte.

[1298345095]

Many thanks for the fast response!

I created the outpost under Outpost → "Docker Service-Connection" and inserted tcp://authentik-socketproxy:2375. The full configuration is as follows:

{
  "pk": "random-pk",
  "name": "authentik-socketproxy",
  "local": true,
  "component": "ak-service-connection-docker-form",
  "verbose_name": "Docker Service-Connection",
  "verbose_name_plural": "Docker Service-Connections",
  "meta_model_name": "authentik_outposts.dockerserviceconnection",
  "url": "tcp://authentik-socketproxy:2375",
  "tls_verification": null,
  "tls_authentication": null
}

I tried local: true and local: false. Only with local: false do I get an entry inside the socket proxy, but it gives:

172.27.0.3:34764 [30/Apr/2023:07:10:53.448] dockerfrontend dockerfrontend/<NOSRV> -1/-1/-1/-1/0 400 188 - - PR-- 1/1/0/0/0 0/0 "<BADREQ>"

For testing purposes, I've granted the socket proxy full access permissions.

offtopic Vielen Dank für die Hilfe! Ich bin beeindruckt, wie gut strukturiert alles aussieht. Es ist selten, so gut durchdachte Projekte zu sehen, weshalb ich Authentik gerne eine Chance gegenüber Keycloak geben möchte.

Can you tell me where can I fill this config? I can't find any blank to fill this json.

[itskagee]

Can you tell me where can I fill this config? I can't find any blank to fill this json.

Settings > Outpost Integrations > Create [Docker Service-Connection]

[danielriddell21]

I got authentik to work without DOCKER_HOST binding and using http://docker-proxy:2375 and local: false.
I needed to set
CONTAINERS=1
POST=1
IMAGES=1
INFO=1

[Jurrer]

Hello people also having this issue.
I just spent a day troubleshooting this problem only to find out that I have connected server container to proxy instead of a worker.
Don't be like me, check your containers and good luck.

[1298345095]

Why Local Docker connection still be "healthy"? I have already commented "/var/run/docker.sock".

[itskagee]

Heads up for anyone coming across this later, you don't need POST=1 anymore.

Since POST access is security critical, I thought I'd mention this here.

[fREAST]

POST=1 is still required if you want Authentik to be able to automatically create and manage outposts.

[itskagee]

Ah, makes sense.

My deployment only uses the embedded outpost so POST wasn't needed there.

Thanks for the update!