ENGDOCS-3081 #23626
ENGDOCS-3081 #23626
Conversation
✅ Deploy Preview for docsdocker ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
github-actions
bot
added
the
area/desktop
There was a problem hiding this comment.
Thanks!
IMHO the most confusing part is the interaction with settings e.g. if using WSL 2 or virtiofs the file access is handled differently; if using Linux the network proxy is different. Maybe a later extension could be to positively recommend particular configurations e.g.
- on Windows: use Hyper-V:
com.docker.backend.exedoes networking + filesharing - on Mac: use virtualization.framework and gRPC FUSE:
com.docker.backenddoes networking + filesharing - on Linux: the file access is performed by
virtiofsdand the network byqemu(<-- I think we should simplify that in the product)
|
|
||
| ## Firewalls and endpoint visibility | ||
|
|
||
| Docker Desktop doesn't include a built-in firewall. |
There was a problem hiding this comment.
One could argue that "air-gapped containers" includes a kind of firewall. Maybe drop this comment to avoid having to bring air-gapped containers into the discussion (for now)?
| Docker Desktop doesn't include a built-in firewall. |
|
|
||
| Use Windows Defender Firewall or enterprise endpoint firewalls for control. This enables traffic inspection and restriction at the host level without modifying the Docker Engine. | ||
|
|
||
| CrowdStrike and similar tools can observe all traffic and file access that passes through the backend process. To monitor in-VM operations, install the agent inside the Docker VM. |
There was a problem hiding this comment.
I think it's possible in theory to install the agent inside the VM, but it's difficult to do in practice because the VM is not persistent, so after a restart it will be gone.
| CrowdStrike and similar tools can observe all traffic and file access that passes through the backend process. To monitor in-VM operations, install the agent inside the Docker VM. | |
| CrowdStrike and similar tools can observe all traffic and file access that passes through the backend process. |
| | Container reads host files | Yes | Access handled by `com.docker.backend` | | ||
| | Container writes host files | Yes | Same process performs the write | | ||
| | Container accesses its own filesystem layers | No | Exists only inside the VM | | ||
| | Endpoint agent inside VM | Yes | Full visibility | |
There was a problem hiding this comment.
Maybe avoid this one for now while we consider how practical it is
| | Endpoint agent inside VM | Yes | Full visibility | |
| Th backend acts as: | ||
|
|
||
| - A network proxy, translating traffic between the host and Linux VM. | ||
| - A file server, using gRPC FUSE which handles file access from containers to the host filesystem. |
There was a problem hiding this comment.
Strictly speaking this depends on the exact filesharing tech in use. It's safest to limit to gRPC FUSE (Windows HyperV and Mac for now)
| - A file server, using gRPC FUSE which handles file access from containers to the host filesystem. | |
| - A file server, if using gRPC FUSE which handles file access from containers to the host filesystem. |
|
|
||
| ## Overview | ||
|
|
||
| Docker Desktop runs the Docker Engine inside a lightweight Linux virtual machine (VM). Docker Desktop routes all network and file operations between the Docker VM and the host through the `com.docker.backend` process. |
There was a problem hiding this comment.
Should we add a filesharing caveat here, that it only does this if using gRPC FUSE (not virtiofs or qemu)?
|
|
||
| Th backend acts as: | ||
|
|
||
| - A network proxy, translating traffic between the host and Linux VM. |
There was a problem hiding this comment.
Unfortunately the network proxy is in a different place by default on Linux, maybe
| - A network proxy, translating traffic between the host and Linux VM. | |
| - A network proxy (on Mac and Windows, for Linux use `qemu`), translating traffic between the host and Linux VM. |
Or we could reference the note at the bottom about Linux (or maybe the note is enough?)
2 participants
High-level info about Docker Desktop networking.
Preview: https://deploy-preview-23626--docsdocker.netlify.app/desktop/features/networking/
Follow-up tasks: