Security review: launch build containers in a separate ephemeral Docker bridge network

[natalieparellano]

Description

In the security review, this is MED-2: Docker permissive inter-container connectivity. The action plan asks us to ensure that

Launch the Docker build containers in a separate ephemeral Docker bridge network

Reference: https://docs.docker.com/network/network-tutorial-standalone/#use-user-defined-bridge-networks

Proposed solution

If pack build --network is NOT set, we should

• create an ephemeral bridge network
• start containers with this network
• tear the network down after the build (or if the build fails for any reason)

We'll probably need to pass --network=host to more acceptance tests, so that build containers can reach the test registry. This ended up not being needed (we are already setting the network for these tests)

Additional context

• This feature should be documented somewhere

[modulo11]

This change broke setups using podman. Apparently slashes are not allowed while it's perfectly fine for docker:

Using build cache volume pack-cache-library_node-npm-sample_latest-a3b5329b03b5.build
ERROR: failed to build: executing lifecycle: failed to create ephemeral bridge network: Error response from daemon: network name pack.local/network/7176696877677273646a invalid: names must match [a-zA-Z0-9][a-zA-Z0-9_.-]*: invalid argument

[natalieparellano]

Apparently slashes are not allowed while it's perfectly fine for docker

That is unfortunate. I'll put up a fix for this. We can release it in the next patch.