Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow plugins to communicate with docker without disabling the sandbox #5489

Closed
tomerd opened this issue May 11, 2022 · 2 comments · Fixed by #6114
Closed

Allow plugins to communicate with docker without disabling the sandbox #5489

tomerd opened this issue May 11, 2022 · 2 comments · Fixed by #6114
Assignees
@abertelrud
Labels
enhancement plugins

Comments

@tomerd
Copy link
Contributor

tomerd commented May 11, 2022

Linux oriented packaging and deployment plugins often need to work with Docker, especially since Swift does not support cross compilation mac -> Linux. As an example see swift-server/swift-aws-lambda-runtime#254

In order to communicate with Docker, plugins need to perform network communication with the docker daemon which is blocked by SwiftPM plugin sandbox. As such, plugins of this kind cannot be used unless the sandbox is disabled which defeats the purpose of having a sandbox.

One possible solution is to model certain types of network communication an grants / privileges that the plugin can express as requiring, and then have SwiftPM prompt the user for explicit approval. this is similar to how plugins deal with file system write access
@tomerd
Copy link
Contributor Author

tomerd commented May 11, 2022

cc @fabianfett

@abertelrud
Copy link
Contributor

This makes sense, and I think there might be an interesting distinction to be drawn (if we can) between localhost and other hosts. Possibly also domain sockets vs IP sockets, if that is a distinction we can make in the sandbox.

neonichu added a commit that referenced this issue Feb 3, 2023
@neonichu
Let command plugins ask for network permissions
54ccb20 
This adds a new plugin permission that allows a command plugin to ask for networking permissions. The permission can distinguish between local and outgoing connections, as well as specifying a list or range of ports to allow. Similar to existing permissions, there's also a CLI option for allowing connections.

resolves #5489
neonichu added a commit that referenced this issue Feb 3, 2023
@neonichu
Let command plugins ask for network permissions
736e565 
This adds a new plugin permission that allows a command plugin to ask for networking permissions. The permission can distinguish between local and outgoing connections, as well as specifying a list or range of ports to allow. Similar to existing permissions, there's also a CLI option for allowing connections.

resolves #5489
@neonichu neonichu mentioned this issue Feb 3, 2023
Merged
neonichu added a commit that referenced this issue Feb 3, 2023
@neonichu
Let command plugins ask for network permissions
ce08da5 
This adds a new plugin permission that allows a command plugin to ask for networking permissions. The permission can distinguish between local and outgoing connections, as well as specifying a list or range of ports to allow. Similar to existing permissions, there's also a CLI option for allowing connections.

resolves #5489
neonichu added a commit that referenced this issue Feb 4, 2023
@neonichu
Let command plugins ask for network permissions
ac28899 
This adds a new plugin permission that allows a command plugin to ask for networking permissions. The permission can distinguish between local and outgoing connections, as well as specifying a list or range of ports to allow. Similar to existing permissions, there's also a CLI option for allowing connections.

resolves #5489
neonichu added a commit that referenced this issue Feb 4, 2023
@neonichu
Let command plugins ask for network permissions
dcf0a19 
This adds a new plugin permission that allows a command plugin to ask for networking permissions. The permission can distinguish between local and outgoing connections, as well as specifying a list or range of ports to allow. Similar to existing permissions, there's also a CLI option for allowing connections.

resolves #5489
neonichu added a commit that referenced this issue Feb 6, 2023
@neonichu
Let command plugins ask for network permissions
83d7b3d 
This adds a new plugin permission that allows a command plugin to ask for networking permissions. The permission can distinguish between local and outgoing connections, as well as specifying a list or range of ports to allow. Similar to existing permissions, there's also a CLI option for allowing connections.

resolves #5489
neonichu added a commit that referenced this issue Feb 8, 2023
@neonichu
Let command plugins ask for network permissions (#6114)
00ac2ad 
This adds a new plugin permission that allows a command plugin to ask for networking permissions. The permission can distinguish between local and outgoing connections, as well as specifying a list or range of ports to allow. Similar to existing permissions, there's also a CLI option for allowing connections.

resolves #5489
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@abertelrud abertelrud

Labels
enhancement plugins
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Let command plugins ask for network permissions swiftlang/swift-package-manager
2 participants
@tomerd @abertelrud