docker-socket-proxy
docker-socket-proxy copied to clipboard
chore: updated to HAproxy 3.0 and forced running as root
Content
This MR bumps haproxy to v3.0 and force it to run as root.
Discussion
Starting with haproxy 2.4, the official/upstream docker image runs with a haproxy user, instead of root (code).
While this is an improvement of their security posture, it's unenviable in the context of docker-socket-proxy. Indeed, haproxy needs to access the docker socket file, which is bound from the host where it belongs to root:docker on a default docker deployment (ie. not rootless).
My take is that docker-socket-proxy should work out of the box with the default docker configuration. And because this MR doesn't deteriorate the current security posture of this project, im submitting it as is.
Tests
Successfully ran locally all the test I could find
poetry run pytest --prebuildpre-commit run --all
It seems correct. @yajo do you see it good for being merged?
@josep-tecnativa please check the error in the CI: https://github.com/Tecnativa/docker-socket-proxy/actions/runs/9854039033/job/27205922038