Do you want to request a feature or report a bug?

Bug

What did you do?

I followed the official instructions to get Traefik running with Docker (and Let's Encrypt).

What did you expect to see?

I would have expected that the part of Traefik which communicates with the Docker daemon and updates Traefik's configuration accordingly when containers are started/stopped would happen in a different container, separate from the Traefik container as the latter is typically exposed to the internet.

What did you see instead?

The official docs instructed me to expose the Docker socket to the Traefik container itself. This is widely recognized to be a serious security issue, see 1, 2, 3, 4 and 5, as it basically means that anyone who manages to compromise Traefik obtains root on the host machine. Note that this is even worse than running a regular (non-Docker-integrated) reverse proxy outside any container directly on the host machine as such a proxy usually doesn't run as root.

Unfortunately, I couldn't find any other way in the docs to get Traefik set up with Docker.

Suggested solution

Move the part of Traefik that regularly pulls the container list from the Docker daemon and updates the Traefik configuration into a separate binary so that it can be run in a separate container, similar to what the nginx-proxy project suggests (see section "separate containers"). This seems to be the only solution that fully isolates the docker.sock-accessing part of the application from network requests. Compared to this, other solutions like using an authz plugin could, in theory, still be compromised.

PS: I am aware that some might consider my report a feature request, not a bug, as the current behavior & instructions seem to be the officially accepted way to integrate Traefik with Docker. However, I still think that any security issue – whether widely accepted or not – should 1) be considered a bug and 2) be at least mentioned in the official documentation.