Instructions published on https://www.home-assistant.io/installation/generic-x86-64 explain how to run the container with the “privileged” flag and in root mode. This can be a disaster for security, especially if your setup is internet facing.
To improve security, we will:
- Run the container as a low privileged user
- Prevent the (user running the) container from acquiring extra privileges
- Define granular capabilities for the container if required
I’m using Docker with docker-compose on a Ubuntu server but the same steps can likely be followed on your prefered container orchestration engine and Linux distro.
- Run the container as a low privileged user
Create a new user and group on your docker host; add user to the group. If required, add yourself to the group as well to easily edit config. files
sudo adduser hassuser
sudo groupadd -g 8123 hassgroup
sudo usermod -a -G hassgroup hassuser
Change ownership of your HA folder where your config. files are
sudo chown -R hassuser:hassgroup /[path_to_config_folder]/
Change permissions so members of your new group can operate. We will allow members of the group to read, write and execute files in this folder
sudo chmod -R g+rwx /[path_to_config_folder]/
Recreate the container:
- Follow the steps described by tribut on https://github.com/tribut/homeassistant-docker-venv, kudos to him for creating the script
- git clone the repo in your HA config. folder
- Update your docker-compose to re-create the container using your new user and the run override.
hass:
image: homeassistant/home-assistant:latest
network_mode: host
volumes:
- /[path_to_config_folder]/:/config
- /[path_to_config_folder]/docker/dockerrun/run:/etc/services.d/home-assistant/run
environment:
- TZ=[your TZ]
- PUID=1001
- PGID=8123
- UMASK=007
- PACKAGES=iputils
2. Prevent the (user runing the) container from acquiring extra privileges
For extra security, you can add to your docker-compose file the following options. This will disable container processes from gaining new privileges.
security_opt:
- no-new-privileges
3. Define granular capabilities for the container if required
I need to leverage the Bluetooth of my host for some HA integration. Based on your needs, you may need to access other hardware or leverage other capabilities. Because now we are in a more secure state, the low privileged user running the container doesn’t have control over BT. Let’s fix that:
sudo usermod -a -G bluetooth hassuser
Now even if our user is part of the BT group, the container itself cannot administer Bluetooth hardware. You need to research which capabilities are needed based on your use case but to give you an example I was trying to use the ble_monitor custom components https://github.com/custom-components/ble_monitor
Add the following to your docker-compose, and be aware of security implications (your container can now administer more networking stuff :
cap_add:
- NET_RAW
- NET_ADMIN
Lastly, update the /[path_to_config_folder]/docker/dockerrun/run to set the capabilities on the python version run into the container - there is probably a better way to do that so it’s future proof based on Python’s version, but you get the idea:
setcap 'cap_net_raw,cap_net_admin+eip' `readlink -f \`which python3.9\``
The next step to improve security will be to stop running the container in host mode, I still need to figure this one out. If you think anything can be improved in this post from a security perspective please let me know, happy to update it… I never used docker and barely used Linux before using HA so pls don’t be too harsh if you find mistakes.
(also posted on reddit on /r/homeassistant/)
