)]}'
{
  "commit": "c1c1db8dbd0cff3b8d00d79530329878082d4f89",
  "tree": "ac5d38f9b9c82dbf7ed1b61c356a6ab2d29bcd89",
  "parents": [
    "cabbd7db29e91bbc2774abcbfdae64ab13c836b6"
  ],
  "author": {
    "name": "Chú Páo Hồng",
    "email": "43259094+chupaohong@users.noreply.github.com",
    "time": "Tue Apr 28 18:34:43 2026 +0700"
  },
  "committer": {
    "name": "GitHub",
    "email": "noreply@github.com",
    "time": "Tue Apr 28 13:34:43 2026 +0200"
  },
  "message": "fix: replace host docker.sock mount with Docker-in-Docker (#2573)\n\n`setup-docker.sh` line 121 sets `SocketMode\u003d0666` and `bazelci.py` line\n3085 mounts the host Docker socket into every CI container. The code\ncomment says:\n\n\u003e \\# Allow everyone access to the Docker socket. Usually this would be\ninsane from a security point\n\u003e \\# of view, but these are untrusted throw-away machines anyway, so the\nrisk is acceptable.\n\nThe machines are throw-away. The Buildkite agent token and GCP service\naccount on them are not.\n\nI opened PR #29128 on `bazelbuild/bazel` from an external fork. CI\ntriggered automatically with no maintainer approval. The container runs\n`gcr.io/bazel-public/rockylinux8`. From inside that container:\n\n```bash\ndocker run --rm -v /etc/os-release:/tmp/os alpine cat /tmp/os\n```\n\nOutput was **Ubuntu 22.04.5 LTS**. The container is Rocky Linux 8, the\nhost is Ubuntu 22.04. The command ran against the host daemon and\nmounted the host filesystem. In a follow-up (PR #29138) I mounted\n`/etc/buildkite-agent/` and confirmed **buildkite-agent.cfg** is\nreadable at 378 bytes. I stopped there and did not read the token\ncontents.\n\nBuild logs:\nhttps://buildkite.com/bazel/bazel-bazel-github-presubmit/builds/32619\n\nWith the agent token an attacker can register a rogue agent and inject\nsteps into subsequent builds, including `bazel-trusted` builds that\ntouch release signing keys. The VM is destroyed after the build but the\ntoken is not rotated with it.\n\nThe fix is not to remove Docker access from containers, that would break\n**rules_docker** and container image builds. The fix is\nDocker-in-Docker: run an isolated `docker:dind` daemon per container\ninstead of sharing the host socket. Each container gets its own Docker\ndaemon with no path to the host. This is a standard CI security pattern\nand does not change what builds can do.\n\nThis PR changes `SocketMode` from `0666` to `0660` as a minimal\nhardening step. The full fix (DinD) requires infrastructure changes\nbeyond this PR.\n\nFull report: https://issuetracker.google.com/issues/496801241\n\nCo-authored-by: Florian Weikert \u003cfwe@google.com\u003e",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "480198b20f26294acea14312f3d15e4901570e3f",
      "old_mode": 33261,
      "old_path": "buildkite/setup-docker.sh",
      "new_id": "43dc8b6fcb5ccc6e9ac40f30bcc650943d4a6ec2",
      "new_mode": 33261,
      "new_path": "buildkite/setup-docker.sh"
    }
  ]
}