docker: use native gRPC for supported local endpoints - #4069
Conversation
5f884e5 to
23d723d
Compare
25e7a23 to
ffa67d0
Compare
| // Native gRPC bypasses the daemon's HTTP authorization middleware. | ||
| // Keep it opt-in until Moby enforces authorization on that path. | ||
| enabled, _ := strconv.ParseBool(os.Getenv("BUILDX_DOCKER_NATIVE_GRPC")) |
There was a problem hiding this comment.
Native gRPC currently bypasses Moby's authorization plugins. httpHandler.ServeHTTP dispatches gRPC requests directly to the gRPC server or extension proxy, bypassing the HTTP API handler where the authorization middleware is registered. Consequently, these requests do not pass through its AuthZRequest check.
This is why native gRPC remains opt-in here. Moby needs to enforce authorization before dispatching native RPCs, covering both local services and the extension proxy while preserving streaming behavior. Keeping Buildx on the legacy transport by default preserves its existing authorization path, but doesn't prevent other clients from accessing the daemon's native gRPC endpoint.
There was a problem hiding this comment.
The /grpc endpoint is deprecated; no need to make it opt-in. Buildx isn't responsible for protecting the API because anything already can do.
There was a problem hiding this comment.
Removed the opt-in. I kept the DialMeta guard because Desktop uses X-Docker-Desktop-idle: background on the /grpc upgrade to let Resource Saver distinguish background connections from interactive builds (https://github.com/docker/desktop-build/pull/312). That's separate from Moby's authorization middleware. These clients retain the legacy transport until equivalent native gRPC behavior is supported and verified.
ffa67d0 to
77cf029
Compare
crazy-max
changed the title
Automatically probe native gRPC support on Unix sockets and named pipes. Share a bounded probe across concurrent callers and keep failed or canceled probes retryable. Retain the legacy transport for remote endpoints and daemons without native gRPC support. Return explicit authentication and authorization failures without falling back. Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
77cf029 to
b4e8db3
Compare
2 participants
Automatically use native gRPC for supported Docker daemons over Unix sockets and named pipes, using the daemon support introduced in moby/moby#50744. Retain the legacy
/grpcand/sessiontransport for remote endpoints and daemons without native gRPC support, preserving Docker's existing TLS and SSH handling. Concurrent callers share a bounded capability probe, and failed or canceled probes remain retryable. Explicit authentication and authorization failures are returned without falling back.