Hello, I want to access the Docker socket API from inside the macOS App Sandbox. The method queries the API using curl with --unix-socket. However, the Sandbox blocks the request, as shown by the log: curl(22299) deny(1) network-outbound /Users/user/.docker/run/docker.sock Outgoing network traffic is generally allowed, but access to the Docker Unix socket is denied.
Here’s the code I’m using:
private func executeDockerAPI() -> String {
let process = Process()
let pipe = Pipe()
process.executableURL = URL(fileURLWithPath: "/usr/bin/curl")
process.arguments = [
"--unix-socket", "/Users/user/.docker/run/docker.sock",
"http://127.0.0.1/containers/json"
]
process.standardOutput = pipe
process.standardError = pipe
do {
try process.run()
process.waitUntilExit()
let data = pipe.fileHandleForReading.readDataToEndOfFile()
if let output = String(data: data, encoding: .utf8) {
return output
} else {
return "Error while decoding"
}
} catch {
return "Error running command: \(error.localizedDescription)"
}
}
Is there any entitlement or sandbox configuration I’m missing to allow access to /Users/user/.docker/run/docker.sock from inside the sandbox?
Are you sandboxing because you plan to ship on the App Store? Or sandboxing because it’s the right thing to do?
Unix domain sockets are a bit of a weird edge case:
-
You can use them for IPC between different components within your app by placing them in an app group container [1].
-
Otherwise they are blocked by the sandbox as part of its general policy of blocking unmediated IPC between code from different teams.
-
You can’t use a temporary exception entitlement to get around this because of both business and technical limitations:
-
On the business side, App Review generally won’t allow you to use temporary exception entitlements.
-
On the technical side, entitlements like
com.apple.security.temporary-exception.files.absolute-path.read-writeonly work for files and directories; they don’t work for Unix domain sockets.
-
If you’re sandboxing your product because it’s the right thing to do then you can get around this by moving the code to a non-sandboxed XPC service. I talk more about this in The Case for Sandboxing a Directly Distributed App.
If you’re targeting the Mac App Store then you can’t use that option. Lemme know if that’s the case and we can talk some more.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
[1] Just use a short app group ID because of the path limits. We recently updated the App Groups Entitlement docs to list these limits.
