allow to expose docker socket via port

[szaimen]

• add ecosystem to startup apps
• add checkbox to aio inteface, disable by default
• if enabled, protect with aio_secret, and/or only allow access from the nextcloud container. Question is how we can proxy that? Probably via apache? but then how to handle the authentication?

See https://github.com/cloud-py-api/app_ecosystem_v2/blob/main/Makefile for reference

[Zoey2936]

can I ask why this is needed?

[szaimen]

So the idea is that the app-ecosystem v2 allows to start docker containers itself. Since AIO is built around docker it would make the install much easier to allow to expose the socket via a port so that the system can manage the things itself.

I was unfortunately included into the project too late to actually make sure that the logic that is built into AIO makes it into the app-ecosystem itself. So the easier way for us now is to simply add this feature (which is disabled by default because of security implications) and make sure that one can enable it if needed.

Also see https://github.com/cloud-py-api/app_ecosystem_v2/tree/main for reference.

[Zoey2936]

so you want something like this (the README is outdated), inbuilt to the mastercontainer?

[szaimen]

Indeed. Thanks for the link! I will look into that going forward :)

[szaimen]

Another idea would be to actually put this into a separate container. Then we could for example even reuse the docker-socket-proxy container. In that case We should probably actually put the mastercontainer, the docker-socket-proxy and the nextcloud container into a dedicated network.

[szaimen]

Will be done in #3235