Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Enhancement] Isolation of deployments and safer security practices. #17

Open
Utkar5hM opened this issue Feb 9, 2024 · 0 comments
Open
Labels
enhancement New feature or request help wanted Extra attention is needed stalled

Comments

@Utkar5hM
Copy link
Collaborator

Utkar5hM commented Feb 9, 2024

Isolation of Deployments:

  • Currently, all deployments can communicate to each other since they are deployed in the same network. To prevent that, We can have a unique network for each deployment and add nginx svc and the deployment's respective database container into the same network so that the container can only talk to these and not anything else. We can use docker network connect/disconnect commands for this.

It would be better to work on this task once #8 is closed as it will change how database containers are handled.

Safer Security Practices:

  • Currently all the deployed containers have Internet access which they shouldn't as that would not only increase the ability of users to do malicious activity on deployments but might also expose services under internal network that the staging server could be a part of. It would be safer to have an option( env variable set to true by default) to add --internal flag to deployment networks.
  • Have a look at securing containers. (maybe gVisor and other things that could help??)
@Utkar5hM Utkar5hM added enhancement New feature or request help wanted Extra attention is needed stalled labels Feb 9, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request help wanted Extra attention is needed stalled
Projects
None yet
Development

No branches or pull requests

1 participant