Running portainer to view containers running on a Windows Kubernetes node

README.md

This is a terrible idea from a security standpoint, but it's fun for demos or tests.

It will run Portainer on whatever node it gets scheduled on, using the Windows named pipe back to the host for Docker management. Be careful because the service in that YAML could end up on a public IP. If someone breaks in, they can create containers at will including mounts to host paths.

docker inspect ... on the container will show that it's handled correctly as a Windows named pipe:

"Mounts": [                                                                                                                                              [88/1899]
            {
                "Type": "npipe",
                "Source": "\\\\.\\pipe\\docker_engine",
                "Destination": "\\\\.\\pipe\\docker_engine",
                "Mode": "",
                "RW": true,
                "Propagation": ""
            },

Once you connect to the service IP, set the initial admin username and password, then add the local host - it will look like this:

You can also double check the named pipe mount using docker.exe included in the container:

$ kubectl exec -i portainer-745d6dfb5f-v8kfb cmd
Microsoft Windows [Version 10.0.17763.253]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is 8E99-CE27

 Directory of C:\

03/28/2019  07:58 PM    <DIR>          data
09/26/2017  10:53 PM        19,868,160 docker.exe
09/15/2018  07:14 AM             5,510 License.txt
03/11/2019  04:04 AM        23,895,552 portainer.exe
03/11/2019  04:05 AM    <DIR>          public
03/11/2019  04:05 AM            26,607 templates.json
01/02/2019  10:16 PM    <DIR>          Users
03/28/2019  07:58 PM    <DIR>          var
03/28/2019  07:58 PM    <DIR>          Windows
               4 File(s)     43,799,925 bytes
               5 Dir(s)  21,246,509,056 bytes free

C:\>docker version
docker version
Client:
 Version:      17.09.0-ce
 API version:  1.32
 Go version:   go1.8.3
 Git commit:   afdb6d4
 Built:        Tue Sep 26 22:40:09 2017
 OS/Arch:      windows/amd64

Server:
 Version:      18.09.2
 API version:  1.39 (minimum version 1.24)
 Go version:   go1.10.6
 Git commit:   1ac774dfdd
 Built:        02/10/2019 04:13:25
 OS/Arch:      windows/amd64
 Experimental: false

portainer.png

portainer.yml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: portainer
  labels:
    app: portainer
spec:
  replicas: 1
  template:
    metadata:
      name: portainer
      labels:
        app: portainer
    spec:
      containers:
      - name: portainer
        image: portainer/portainer
        resources:
          limits:
            cpu: 2
            memory: 2000m
          requests:
            cpu: .1
            memory: 1000m
        ports:
          - containerPort: 9000
        volumeMounts:
          - mountPath: \\.\pipe\docker_engine
            name: docker-pipe
      volumes:
        - name: docker-pipe
          hostPath: 
            path: \\.\pipe\docker_engine
            type: null
      nodeSelector:
        "beta.kubernetes.io/os": windows
  selector:
    matchLabels:
      app: portainer
---
apiVersion: v1
kind: Service
metadata:
  name: portainer
spec:
  type: LoadBalancer
  ports:
  - protocol: TCP
    port: 9000
  selector:
    app: portainer