Skip to content

docs: further clarify authz plugins #6998

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mickael-docker wants to merge 1 commit into
base: master
Choose a base branch
from
+8 −5
Open

docs: further clarify authz plugins #6998

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 8 additions & 5 deletions docs/extend/plugins_authorization.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,11 +74,14 @@ The sequence diagrams below depict an allow and deny authorization flow:
Each request sent to the plugin includes the authenticated user, the HTTP
headers, and the request/response body. Only the user name and the
authentication method used are passed to the plugin. Most importantly, no user
credentials or tokens are passed. Finally, not all request/response bodies
are sent to the authorization plugin. Only request/response bodies where
the `Content-Type` is `application/json` are sent to the authorization plugin;
bodies of any other `Content-Type` are not visible to the plugin and cannot
be used for enforcement, even though the daemon may still act on this data.
credentials or tokens are passed.

> [!NOTE]
> Authorization plugins enforce requests to the Docker daemon's HTTP API only. gRPC method
> calls, whether dispatched natively or upgraded through `POST /grpc`, are not subject to authorization.
> Furthermore, HTTP request/response bodies where the `Content-Type` is `application/json` are forwarded;
> bodies of any other type are not visible to the plugin and cannot be used for enforcement,
> even though the daemon acts on this data.

For commands that can potentially hijack the HTTP connection (`HTTP
Upgrade`), such as `exec`, the authorization plugin is only called for the
Expand Down
Loading