Is plumbr secure?

Question

The way I understand it is that plumbr allows you to turn any R script into an API end point. You can send requests to the API end point and it will return the output that you define in the R script.

Let's assume that I host the script in a Docker instance and that the machine sending the api request has an ssh tunnel to the machine.

Let's say I send this dataframe as a response to an api request in plumbr.

my_data <- data.frame(city = c("Chicago", "New York", "Cincinatti", "Green Bay"), value = c(30, 50, 70, 95))

What's the path that it has to travel to go between my request and my receiving the data?

Is it going through external machines along that path?

You define the port inside the `r-script` example: `require(plumber) r <- plumb("lib/routes.R") r$run(host="0.0.0.0",port=8000)` — Víctor Cortés, May 03 '20 at 06:37
Also you'll have to configure a Dockerfile installing all the dependencies and expose the port. If you want that another services have access to the `R` container you will have to link it inside a docker-compose. — Víctor Cortés, May 03 '20 at 06:45
Does anyone from plumber have access to the data at any point? — Cauder, May 03 '20 at 06:47
Anyone who knows the `endpoint` will have access, I think that the security part will have to handle the `r-script` or another backend service connected to the plumber container. — Víctor Cortés, May 03 '20 at 06:50
Excellent! It sounds like as long as I set up the docker instance and the endpoint securely, then I should be good to go. Can you tell me more about hiw it's traveling from my script to the docker instance and back? — Cauder, May 03 '20 at 06:51

Víctor Cortés · Accepted Answer · 2020-05-04T12:52:48.727

In order to use plumber inside a docker container you will have to:

Make a Dockerfile with all the dependencies
Link inside docker-compose.yml

Make the Dockerfile

In this example you make an image with an r-script which route is src/myscript.R

FROM rocker/r-apt:bionic

RUN apt-get update && \
    apt-get install -y -qq \
    libmariadb-client-lgpl-dev \
    r-cran-plumber \
    r-cran-reshape2 \
    r-cran-rmysql \
    r-cran-dplyr

COPY src src
RUN chmod 755 src

WORKDIR /src
RUN chmod 777 myscript.R

EXPOSE 8000

CMD ["Rscript","myscript.R"]

In order to build the image with the Dockerfile run

docker image build -t my-plumber-image .

Note that the . at the end is the current work directory and -t stands for "tag"

Link the image inside docker-compose

version: '3'

services:
 mysql:
   image: mysql:5.7
   container_name: mysql-container
   environment:
     - MYSQL_ROOT_PASSWORD=mypassword
   ports:
     - "3306:3306"
 plumber:
   image: my-plumber-image
   build: my-plumber-image
   container_name: plumber-container
   ports:
     - "8000:8000"
   links:
     - mysql

After link the plumber to the other services you can have access through the port 8000 like any other POST/GET request. The ip is defined by the localmachine.

I recommend you to use postman for the request tests. Hope this can help you.

I didn't mention any example with R and plumber because in their website it's a really good short one.

DB connection

If you want to make a connection to a container use the following script:

DB_conn <- function(){
return(RMySQL::dbConnect(RMySQL::MySQL(),
          user = 'root', 
          password = 'mypassword',
          dbname = 'mydatabase',
          host = HOST, # Container name like "myservice_mysql_1" look in the logs
          port = PORT) # Default port 3306 
      )
}

Can I encrypt the tunnel between docker and the machine that runs the commands? — Cauder, May 03 '20 at 16:01
Haven't marked this complete because it's unclear whether plumbr has access to the data — Cauder, May 03 '20 at 16:53
In this example plumbr can access to MySQL container (specified in docker-compose.yml as `links`), so is just matter of DB configuration inside your R-script to retrieved data from the DB. If you want for example to grant access to a Mongo DB you'll have to link it inside the docker-compose.yml — Víctor Cortés, May 04 '20 at 12:43

Is plumbr secure?

1 Answers1