Why must docker.sock be mounted inside the MegaLinter container?

[sanmai-NL]

There are multiple mechanisms to schedule containers on a target host. Rather than instructing users to mount this socket by default, which introduces a security weakness, I propose that we offer options.

• Describe $DOCKER_HOST and options to set it up.
• Offer Kubernetes manifests.
• Offer means to enhance existing Containerfiles to add linters and MegaLinter tooling, rather than building a separate MegaLinter image.
• Describe ways to integrate with popular CI systems and their container engines.

[nvuillam]

Few linters (maybe swiftlint only) are run using directly their docker image, that's what docker.sock must be sent.... except if you don't use swiftlint :)

[sanmai-NL]

This violates rule #1 of the OWASP Docker Security checklist. Seems like a huge price to pay to support Swiftlint. And I proposed some alternative mechanisms in the opening post.

[nvuillam]

I'm not sure swiftlint is very used, maybe we could indeed deprecate it in a future version if we don't find a way to install it directly on our docker image

I'm no k8 expert but if you want to make POC, they are very welcome :) ( cc @Kurt-von-Laven @bdovaz @echoix )

[sanmai-NL]

Writing a few Kubernetes manifests is easy, but the architecture would be different. Instead of writing large Containerfiles, you would define a set of preconfigured upstream container images. See #2719