Comments (10)
Thanks for reporting, @sozercan! It looks like MCR decides at runtime what location to pull from.
Investigating this issue is in the backlog and we will get to it soon.
@h0x0er please investigate this next. Thanks!
from harden-runner.
@h0x0er is working on implementing this feature. We plan to release it in two week. I will share rc
build to try out in a few days.
from harden-runner.
This feature is now available on the rc
tag. Here are a couple of examples. Please try it out and let me know if you have any feedback or questions.
from harden-runner.
Hi @jauderho, can you please share a link to a workflow where you observed this? Thanks!
from harden-runner.
Interesting, harden-runner does not actually capture the subdomain in the harden-runner output: https://app.stepsecurity.io/github/jauderho/dockerfiles/actions/runs/3965278228
But this can be see in the GHA output: https://github.com/jauderho/dockerfiles/actions/runs/3965278228/jobs/6794861825#step:20:51
This is for a successful run where mcr.microsoft.com resolves to eastus.mcr.microsoft.com
from harden-runner.
This is for an unsuccessful run. I just enabled telemetry and set to block.
- https://app.stepsecurity.io/github/jauderho/dockerfiles/actions/runs/3965404061
- https://github.com/jauderho/dockerfiles/actions/runs/3965404061/jobs/6795095110#step:20:81
As you can see from the harden-runner output, only mcr.microsoft.com shows up in the recommended policy for allowed-endpoints but not eastus.data.mcr.microsoft.com.
from harden-runner.
seeing the same issue after changing egress policy to block
while allowlisting mcr.microsoft.com
https://github.com/Azure/eraser/actions/runs/4028112467/jobs/6924673782#step:10:31
from harden-runner.
@varunsh-coder, I found that mcr.microsoft.com
is used for content-discovery
, whereas in order to download image blobs various region specific content-delivery
endpoints are used.
The structure of content-delivery endpoints is <region>.data.mcr.microsoft.com
. List of regions can be found here.
On executing the below command you will notice; a call to content-discovery
endpoints redirects to region specific content-delivery
endpoint.
curl https://mcr.microsoft.com/v2/dotnet/aspnet/blobs/sha256:ac9a37082c6dec16dd5bd45d54a08f2e479d37222f2732f5b464e9dd5d454f0a
Ref:
- https://github.com/microsoft/containerregistry/blob/main/client-firewall-rules.md
- https://github.com/microsoft/containerregistry/blob/main/docs/mcr-endpoints-guidance.md
from harden-runner.
I have updated the title to a more generic feature - Support wildcard domains.
from harden-runner.
This has been released in v2.4.0
https://docs.stepsecurity.io/harden-runner/how-tos/block-egress-traffic#support-for-wildcard-domains
from harden-runner.
Related Issues (20)
- Cache endpoint is not auto-detected on first run HOT 1
- Add option to fail build if annotations are added
- Allow blocking traffic based on HTTP path and verbs
- Support comments in allowed endpoints
- Enable setting allowed-endpoints via insights website HOT 6
- Unexpected blockage of multicast socket HOT 2
- Investigate run statnett/image-scanner-operator - 3953485836 HOT 1
- Do not show `api.snapcraft.io` in insights report HOT 1
- Call to internal domains are blocked when using TestContainers HOT 1
- Docker build fails with update to 2.2.0 HOT 3
- Enable storing harden-runner policy in a separate file
- Logo in build summary is not readable on the Dark Theme HOT 4
- Remove reference to `context.payload.repository` HOT 1
- Allowed endpoint could not be resolved HOT 2
- Surface audit log of changes to policy store
- Harden-Runner step should not fail when the workflow is running in ARC HOT 1
- Add a way to exempt specific files for some workflows for overwrite detection
- Please whitelist *.actions.githubusercontent.com HOT 8
- Implement Harden-Runner for more CI/CD Providers (Jenkins/ GitLab CI etc)
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from harden-runner.