Seagull – A friendly web UI to monitor a Docker daemon

by johnwards • 12 years ago

36 12 12 years ago

truffles• 12 years ago

Many people don't realize this, but Docker has a pretty good, and very simple JSON API.

Not only can you connect from anywhere with the docker client, but you can also use any other HTTP(s) speaking tool including curl or even your browser directly.

TLS certificate authentication is supported by the docker daemon by default (it's a flag away), and using that is a lot more secure than using an unauthenticated web UI like this, which is dangerously close to giving root access to your server to anyone who can route to your port.

Alupis2• 12 years ago

which is dangerously close to giving root access to your server to anyone who can route to your port

Part of the reason CoreOS says: "From a security and composability perspective, the Docker process model - where everything runs through a central daemon - is fundamentally flawed ... [Docker is] all compiled into one monolithic binary running primarily as root on your server"[1]

[1] https://coreos.com/blog/rocket/

shykes3• 12 years ago

That makes no sense whatsoever. By default the Docker daemon listens only on a local unix socket only accessible to root (and in some distros a separate root-equivalent group).

The CoreOS model relies on running all containers via another centralized daemon: systemd. Feel free to expose an unauthenticated web UI to manage systemd, and see what happens security-wise.

Note: full disclosure, I also downvoted you, not because I disagree with you (that's what the above rebuttal is for), but because based on your prior comments on this topic, you are being deliberately obtuse and aggressive, and no amount of reasonable debate or explanation seems to change that. I look forward to your response (or seeing this comment and all others by me downvoted exactly once) which will probably demonstrate my point.

agumonkey• 12 years ago

I think that's Brian Cantrill (Solaris) who said that's one of Docker's killer feature. This HTML frontend feels quite nice.

shykes3• 12 years ago

Everything you say is true, but it doesn't mean this web ui is not useful, or a bad idea. It just means that it should add authentication :)

Since we are developing Docker's identity and authentication primitives separately from the main binary (https://github.com/docker/libtrust), it would be a cool experiment to try using that in Seagul.

Personally I think this is a cool project, and look forward to seeing it evolve!

tobegit3hub2• 12 years ago

I'm the author of seagull. Thanks for all your attention.

Seagull is kind of for developers now and it's insecure at all. We're glad to know more about libtrust and try to add authentication for all kinds of users.

The issue is open and anyone who is interested in it could help to improve it.

dbrian• 12 years ago

Leave iptables on and port forward with SSH to localhost. Same thing people do with elasticsearch or other non-authenticated services.

These are early stage projects. The ones that stick around will get more enterprise-y over time.

bob917• 12 years ago

Is there a roadmap for Braille support?

tobegit3hub2• 12 years ago

Do you mean supporting authentication? We add it in our issue list and have no exact date to implement it.

Please participate in the community and help us to improve it.

datashaman• 12 years ago

Surely that's not a live instance you're demoing?

Seagull – A friendly web UI to monitor a Docker daemon

Related Stories