FR - Read only mode

[cherouvim]

Problem Description

Dockwatch looks great. I want to use it, but I don't want to allow its users to alter the docker state in any way (e.g remove orphans etc). Would that be possible somehow?

Proposed Solution

Maybe a config option?

Alternatives Considered

I attempted to block POSTs via my proxy, but Dockwatch uses POST for read actions as well.

Dockwatch Version

latest

Additional context

No response

[bakerboy448]

but I don't want to allow its users

One Dockwatch instance, multiple users off what you're trying to do?

Else if per container a Docker socket proxy sounds like what you're looking for

[cherouvim]

what you're trying to do?

I want to provide my users (those who are deploying containers on my server) with the node dockwatch metric/observability capabilities (memory, cpu, networks etc) but not allow them to alter or create anything on the server (compose, remove orphan images) via the dockwatch UI.

[austinwbest]

I want to provide my users (those who are deploying containers on my server) with the node dockwatch metric/observability capabilities (memory, cpu, networks etc) but not allow them to alter or create anything on the server (compose, remove orphan images) via the dockwatch UI.

If they are deploying containers and have access to the UI, how exactly would you stop them if they wanted to make changes? Even if there was a flag or user system or api block or whatever, them having access kinda nullifies that.

Could also be i dont fully understand the usecase/scope of it. If you want to hop on discord we can talk about it a bit easier/faster

I attempted to block POSTs via my proxy, but Dockwatch uses POST for read actions as well.

I cant think of any endpoints that use POST for pulling data, if you let me know which ones we can look into that as well. Unless you are referring to the AJAX requests from the UI in which case yes, it uses POST requests to keep updated. You can block POST across the API via nginx if you really wanted to but it might be good to discuss this further before going that route.

[cherouvim]

Visiting the frontpage does a POST to /ajax/overview.php.
Visiting the containers page does a POST to /ajax/containers.php.
Visiting the networks page does a POST to /ajax/networks.php.

As per https://www.w3.org/2001/tag/doc/whenToUseGet.html these should be GET.

This is the general ideal scenario though. My intent is not to change anything on dockwatch. The original feature request I did was that I'd like to have a read only mode of this software.

My users can manage and deploy containers via other means which provide strong authentication and authorization guarantees. I'd like to introduce dockwatch into my (their) toolset, but since I only want that for read only metrics and observability, I cannot easily do so now.

I understand, though, that maybe my ask if not in line with the purpose and strategy of dockwatch in general.

[austinwbest]

For nearly 20 years i have always used POST for ajax reqeusts as it simplifies my life and code to not have to swap back and forth from request to request, especially since many requests change over time and can start including parameters which would then require the method to change based on that usage and anyone using those methods would then have to also update code & it causes deprication, sunsetting, warnings being sent out about the changes, etc.

It is not worth the hassle and has worked pretty well for my use over a couple decades.

Anyhow, about your request.. Your users wont have access to the dockwatch compose, this is correct? If so we could add an ENV for DW_ACCESS with different levels fairly easily. 0/null: full access, 1: read only (no posting to the api), 2: read/update (no deleting things to the api) but could still change parameters such as the instance name, update frequency, etc

[cherouvim]

Whether a request is called by XHR or not shouldn't dictate its method. It's good that you have patterns which have been working for you for decades, but this doesn't make them correct. No need to change anything though; this is a philosophical discussion.

[austinwbest]

Whether a request is called by XHR or not shouldn't dictate its method. It's good that you have patterns which have been working for you for decades, but this doesn't make them correct. No need to change anything though; this is a philosophical discussion.

What about the other half of the post above bud? The section about your request.

[cherouvim]

Yes, having an ENV which will change the behavior of the system to read-only is what I initially requested.

I also used https://github.com/google/cadvisor and https://github.com/nicolargo/glances, but, having a dockwatch in read-only mode is exactly what I prefer and need for my use case. Maybe it's useful for others too - maybe not.

[austinwbest]

Now that i have cut a new main i will look into getting this added.

[austinwbest]

Yes, having an ENV which will change the behavior of the system to read-only is what I initially requested.

I also used https://github.com/google/cadvisor and https://github.com/nicolargo/glances, but, having a dockwatch in read-only mode is exactly what I prefer and need for my use case. Maybe it's useful for others too - maybe not.

If you are available to join the discord so we can talk about how you need this to be, that would be great. I figure we can build the initial release to your needs and adjust later to others as needed (if needed)