Docker Daemon Fails to Restart After Applying OPA Authorization Policy

[Sachita007]

When using the following basic configuration, Docker builds and restarts successfully:

package docker.authz

allow := true

However, when applying this policy:

package docker.authz

default allow = false

allow if {
  input.Method = "POST"
  input.Body.User != "0"
  input.Body.User != ""
  input.Body.User != "root"
  contains(input.Path, "exec")
}

allow if {
  input.Method = "GET"
}

allow if {
  input.Method = "HEAD"
}

allow if {
  contains(input.Path, "resize")
}

allow if {
  contains(input.Path, "start")
}

Docker builds without errors, but the Docker daemon fails to restart. The following log is observed:

Mar 02 09:55:51 docker dockerd[4212]: failed to validate authorization plugin: plugin openpolicyagent/opa-docker-authz-v2:0.9 found but disabled
Mar 02 09:55:51 docker systemd[1]: docker.service: Main process exited, code=exited, status=1/FAILURE

Would appreciate insights on why this policy causes Docker to fail and potential solutions.

[anderseknert]

Hi there! I believe that image may not run a version of OPA post 1.0+, which that policy requires. Could you please file an issue about this in the https://github.com/open-policy-agent/opa-docker-authz repo?

[anderseknert]

You can find more up to data images in the same repo: https://github.com/open-policy-agent/opa-docker-authz/pkgs/container/opa-docker-authz

See also: open-policy-agent/opa-docker-authz#99 for a suggested improvement related to this.