centersl/docker-docs
1
0
Fork 0
mirror of https://github.com/docker/docs.git synced 2026-03-27 14:28:47 +07:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #23515 from gtardif/extension_binary_exec_on_host

Browse Source 
Update extension documentation: the SDK to execute commands on the host is not restricted to binaries listed in the extension metadata.
This commit is contained in:
Guillaume Tardif
2025-10-10 15:59:50 +02:00
committed by GitHub
parent 36933945ba a4939817c6
commit fa132e348d
4 changed files with 5 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
content/manuals/extensions/extensions-sdk/architecture/security.md
View File

@@ -16,6 +16,7 @@ An extension can have the following optional parts:
* Executables deployed on the host machine.
Extensions are executed with the same permissions as the Docker Desktop user. Extension capabilities include running any Docker commands (including running containers and mounting folders), running extension binaries, and accessing files on your machine that are accessible by the user running Docker Desktop.
Note that extensions are not restricted to execute binaries that they list in the [host section](../architecture/metadata.md#host-section) of the extension metadata: since these binaries can contain any code running as user, they can in turn execute any other commands as long as the user has rights to execute them.
The Extensions SDK provides a set of JavaScript APIs to invoke commands or invoke these binaries from the extension UI code. Extensions can also provide a backend part that starts a long-lived running container in the background.

3
content/manuals/extensions/extensions-sdk/dev/api/backend.md
View File

@@ -110,8 +110,7 @@ console.log(output);
## Invoke an extension binary on the host
You can run binaries defined in the [host section](../../architecture/metadata.md#host-section)
of the extension metadata.
Invoke a binary on the host. The binary is typically shipped with your extension using the [host section](../../architecture/metadata.md#host-section) in the extension metadata. Note that extensions run with user access rights, this API is not restricted to binaries listed in the [host section](../../architecture/metadata.md#host-section) of the extension metadata (some extensions might install software during user interaction, and invoke newly installed binaries even if not listed in the extension metadata).
For example, execute the shipped binary `kubectl -h` command in the host:

5
content/manuals/extensions/extensions-sdk/guides/invoke-host-binaries.md
View File

@@ -13,15 +13,14 @@ provides, or even a shell script that you want to run on the host.
You could do that by executing the CLI from a container with the extension SDK. But this CLI needs to access the host's filesystem, which isn't easy nor fast if it runs in a container.
However host binaries invoke from the extension executables (as binaries, shell scripts)
shipped as part of your extension and deployed to the host. As extensions can run on multiple platforms, this
This page describes how to run executables on the host (binaries, shell scripts) that are shipped as part of your extension and deployed to the host. As extensions can run on multiple platforms, this
means that you need to ship the executables for all the platforms you want to support.
Learn more about extensions [architecture](../architecture/_index.md).
> [!NOTE]
>
> Only executables shipped as part of the extension can be invoked with the SDK.
> Note that extensions run with user access rights, this API is not restricted to binaries listed in the [host section](../architecture/metadata.md#host-section) of the extension metadata (some extensions might install software during user interaction, and invoke newly installed binaries even if not listed in the extension metadata).
In this example, the CLI is a simple `Hello world` script that must be invoked with a parameter and returns a
string.

2
content/reference/api/extensions-sdk/DockerDesktopClient.md
View File

@@ -407,7 +407,7 @@ ___
▸ **execHostCmd**(`cmd`): `Promise`<[`ExecResultV0`](ExecResultV0.md)\>
You can run binaries defined in the host section in the extension metadata.
Invoke a binary on the host. The binary is typically shipped with your extension using the host section in the extension metadata. Note that extensions run with user access rights, this API is not restricted to binaries listed in the host section of the extension metadata (some extensions might install software during user interaction, and invoke newly installed binaries even if not listed in the extension metadata)
```typescript
window.ddClient.execHostCmd(`cliShippedOnHost xxx`).then((cmdResult: any) => {